CVE-2022-35236: HTTP2 profile vulnerability CVE-2022-35236

Q: What is CVE-2022-35236?

CVE-2022-35236 is a vulnerability in BIG-IP versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5 that allows undisclosed traffic to cause an increase in memory resource utilization.

Q: How does CVE-2022-35236 affect F5 BIG-IP Access Policy Manager?

CVE-2022-35236 affects F5 BIG-IP Access Policy Manager versions 14.1.x, 15.1.x, and 16.1.x by causing an increase in memory resource utilization when an HTTP2 profile is configured on a virtual server.

Q: How can I mitigate CVE-2022-35236?

To mitigate CVE-2022-35236, update your F5 BIG-IP software to version 16.1.2.2, 15.1.6.1, or 14.1.5.

Q: What is the severity of CVE-2022-35236?

CVE-2022-35236 has a severity rating of 7.5 (High).

Q: Where can I find more information about CVE-2022-35236?

You can find more information about CVE-2022-35236 on the F5 support website at: https://support.f5.com/csp/article/K79933541

Published Aug 4, 2022

Updated

In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

33 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.5

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.6.1

F5 BIG-IP Access Policy Manager>=16.1.0<16.1.2.2

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.5

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.6.1

F5 BIG-IP Advanced Firewall Manager>=16.1.0<16.1.2.2

F5 BIG-IP Analytics>=14.1.0<14.1.5

F5 BIG-IP Analytics>=15.1.0<15.1.6.1

F5 BIG-IP Analytics>=16.1.0<16.1.2.2

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.5

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.6.1

F5 Big-ip Application Acceleration Manager>=16.1.0<16.1.2.2

F5 BIG-IP Application Security Manager>=14.1.0<14.1.5

F5 BIG-IP Application Security Manager>=15.1.0<15.1.6.1

F5 BIG-IP Application Security Manager>=16.1.0<16.1.2.2

F5 Big-ip Domain Name System>=14.1.0<14.1.5

F5 Big-ip Domain Name System>=15.1.0<15.1.6.1

F5 Big-ip Domain Name System>=16.1.0<16.1.2.2

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.5

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.6.1

F5 Big-ip Fraud Protection Service>=16.1.0<16.1.2.2

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.5

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.6.1

F5 Big-ip Global Traffic Manager>=16.1.0<16.1.2.2

F5 Big-ip Link Controller>=14.1.0<14.1.5

F5 Big-ip Link Controller>=15.1.0<15.1.6.1

F5 Big-ip Link Controller>=16.1.0<16.1.2.2

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.5

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.6.1

F5 Big-ip Local Traffic Manager>=16.1.0<16.1.2.2

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.5

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.6.1

F5 Big-ip Policy Enforcement Manager>=16.1.0<16.1.2.2

Event History

Aug 4, 2022

CVE Published

via MITRE·05:48 PM

Data Sourced

via MITRE·05:48 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-35236?

CVE-2022-35236 is a vulnerability in BIG-IP versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5 that allows undisclosed traffic to cause an increase in memory resource utilization.

How does CVE-2022-35236 affect F5 BIG-IP Access Policy Manager?

CVE-2022-35236 affects F5 BIG-IP Access Policy Manager versions 14.1.x, 15.1.x, and 16.1.x by causing an increase in memory resource utilization when an HTTP2 profile is configured on a virtual server.

How can I mitigate CVE-2022-35236?

To mitigate CVE-2022-35236, update your F5 BIG-IP software to version 16.1.2.2, 15.1.6.1, or 14.1.5.

What is the severity of CVE-2022-35236?

CVE-2022-35236 has a severity rating of 7.5 (High).

Where can I find more information about CVE-2022-35236?