CVE-2022-35272: BIG-IP HTTP MRF vulnerability CVE-2022-35272

Q: What is the severity of CVE-2022-35272?

The severity of CVE-2022-35272 is high.

Q: Which software versions are affected by CVE-2022-35272?

BIG-IP versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1 are affected by CVE-2022-35272.

Q: How can I fix CVE-2022-35272?

Upgrade your BIG-IP software to version 17.0.0.1 or 16.1.3.1 to fix CVE-2022-35272.

Q: What is the impact of CVE-2022-35272?

CVE-2022-35272 may cause the Traffic Management Microkernel (TMM) to produce a core file and terminate the connection.

Q: Where can I find more information about CVE-2022-35272?

You can find more information about CVE-2022-35272 at the following link: https://support.f5.com/csp/article/K90024104

Published Aug 4, 2022

Updated

In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

22 affected components

F5 BIG-IP Access Policy Manager>=16.1.0<16.1.3.1

F5 BIG-IP Access Policy Manager=17.0.0

F5 BIG-IP Advanced Firewall Manager>=16.1.0<16.1.3.1

F5 BIG-IP Advanced Firewall Manager=17.0.0

F5 BIG-IP Analytics>=16.1.0<16.1.3.1

F5 BIG-IP Analytics=17.0.0

F5 Big-ip Application Acceleration Manager>=16.1.0<16.1.3.1

F5 Big-ip Application Acceleration Manager=17.0.0

F5 BIG-IP Application Security Manager>=16.1.0<16.1.3.1

F5 BIG-IP Application Security Manager=17.0.0

F5 Big-ip Domain Name System>=16.1.0<16.1.3.1

F5 Big-ip Domain Name System=17.0.0

F5 Big-ip Fraud Protection Service>=16.1.0<16.1.3.1

F5 Big-ip Fraud Protection Service=17.0.0

F5 Big-ip Global Traffic Manager>=16.1.0<16.1.3.1

F5 Big-ip Global Traffic Manager=17.0.0

F5 Big-ip Link Controller>=16.1.0<16.1.3.1

F5 Big-ip Link Controller=17.0.0

F5 Big-ip Local Traffic Manager>=16.1.0<16.1.3.1

F5 Big-ip Local Traffic Manager=17.0.0

F5 Big-ip Policy Enforcement Manager>=16.1.0<16.1.3.1

F5 Big-ip Policy Enforcement Manager=17.0.0

Event History

Aug 4, 2022

CVE Published

via MITRE·05:49 PM

Data Sourced

via MITRE·05:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-35272?

The severity of CVE-2022-35272 is high.

Which software versions are affected by CVE-2022-35272?

BIG-IP versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1 are affected by CVE-2022-35272.

How can I fix CVE-2022-35272?