CVE-2022-41770: BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5 BIG-IP (iControl REST)to a version that resolves this vulnerability.Fixed in 17.0.0.1 - Upgrade
Upgrade
F5 BIG-IP (iControl REST)to a version that resolves this vulnerability.Fixed in 16.1.3.1 - Upgrade
Upgrade
F5 BIG-IP (iControl REST)to a version that resolves this vulnerability.Fixed in 15.1.7 - Upgrade
Upgrade
F5 BIG-IP (iControl REST)to a version that resolves this vulnerability.Fixed in 14.1.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41770?
CVE-2022-41770 has been identified with a moderate severity level, impacting memory resource utilization.
How do I fix CVE-2022-41770?
To remediate CVE-2022-41770, upgrade to the latest patched version of BIG-IP or BIG-IQ as specified in the F5 security advisories.
Which versions are affected by CVE-2022-41770?
CVE-2022-41770 affects multiple versions of F5 BIG-IP and BIG-IQ, specifically versions before 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1, and all of 13.1.x.
What are the implications of CVE-2022-41770?
The implications of CVE-2022-41770 include potential denial of service due to increased memory resource utilization.
Is there a workaround for CVE-2022-41770?
While the recommended action is to upgrade, limiting access to the iControl REST interface can mitigate the risk of exploitation for CVE-2022-41770.