CVE-2023-22664: BIG-IP HTTP/2 profile vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-22664.

Q: What is the severity of CVE-2023-22664?

The severity of CVE-2023-22664 is high with a CVSS score of 7.5.

Q: How does CVE-2023-22664 affect virtual servers?

CVE-2023-22664 can cause an increase in memory resource utilization when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server.

Q: How can I fix CVE-2023-22664?

To fix CVE-2023-22664, you should update to BIG-IP versions 17.0.0.2 or later, or 16.1.3.3 or later.

Published Feb 1, 2023

Updated

On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

29 affected componentsFixes available

F5 BIG-IP=17.0.0

17.1.0

F5 BIG-IP>=16.1.0<=16.1.3

16.1.3.3

F5 BIG-IP

F5 BIG-IP SPK=1.6.0

1.7.0

F5 BIG-IP Access Policy Manager>=16.1.0<16.1.3.3

F5 BIG-IP Access Policy Manager>=17.0.0<17.0.0.2

F5 BIG-IP Advanced Firewall Manager>=16.1.0<16.1.3.3

F5 BIG-IP Advanced Firewall Manager>=17.0.0<17.0.0.2

F5 BIG-IP Analytics>=16.1.0<16.1.3.3

F5 BIG-IP Analytics>=17.0.0<17.0.0.2

F5 Big-ip Application Acceleration Manager>=16.1.0<16.1.3.3

F5 Big-ip Application Acceleration Manager>=17.0.0<17.0.0.2

F5 BIG-IP Application Security Manager>=16.1.0<16.1.3.3

F5 BIG-IP Application Security Manager>=17.0.0<17.0.0.2

F5 Big-ip Ddos Hybrid Defender>=16.1.0<16.1.3.3

F5 Big-ip Ddos Hybrid Defender>=17.0.0<17.0.0.2

F5 Big-ip Domain Name System>=16.1.0<16.1.3.3

F5 Big-ip Domain Name System>=17.0.0<17.0.0.2

F5 Big-ip Fraud Protection Service>=16.1.0<16.1.3.3

F5 Big-ip Fraud Protection Service>=17.0.0<17.0.0.2

F5 Big-ip Link Controller>=16.1.0<16.1.3.3

F5 Big-ip Link Controller>=17.0.0<17.0.0.2

F5 Big-ip Local Traffic Manager>=16.1.0<16.1.3.3

F5 Big-ip Local Traffic Manager>=17.0.0<17.0.0.2

F5 Big-ip Policy Enforcement Manager>=16.1.0<16.1.3.3

F5 Big-ip Policy Enforcement Manager>=17.0.0<17.0.0.2

F5 BIG-IP SSL Orchestrator>=16.1.0<16.1.3.3

F5 BIG-IP SSL Orchestrator>=17.0.0<17.0.0.2

F5 Big-ip Service Proxy Kubernetes=1.6.0

Event History

Feb 1, 2023

Advisory Published

via F5·01:27 PM

CVE Published

via MITRE·05:56 PM

Data Sourced

via MITRE·05:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-22664.

What is the severity of CVE-2023-22664?

The severity of CVE-2023-22664 is high with a CVSS score of 7.5.

Which versions of BIG-IP are affected by CVE-2023-22664?

BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3 are affected by CVE-2023-22664.

How does CVE-2023-22664 affect virtual servers?

CVE-2023-22664 can cause an increase in memory resource utilization when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server.

How can I fix CVE-2023-22664?