CVE-2023-43124: BIG-IP APM Clients TunnelCrack vulnerability
Published Sep 27, 2023
·Updated
BIG-IP APM clients may send IP traffic outside of the VPN tunnel.
Affected Software
15 affected componentsFixes available
F5 BIG-IP Access Policy Manager>=14.1.5.2<=14.1.5.6
F5 BIG-IP Access Policy Manager>=15.1.8<=15.1.10
F5 BIG-IP Access Policy Manager>=16.1.3.3<=16.1.4
F5 BIG-IP Access Policy Manager=13.1.5.1
F5 BIG-IP Access Policy Manager=17.1.0
F5 Big-ip Access Policy Manager Client>=7.2.3<=7.2.4
F5 BIG-IP APM>=17.1.0<=17.1.1
3
F5 BIG-IP APM=16.1.3.3
3
F5 BIG-IP APM=15.1.8
3
F5 BIG-IP APM>=14.1.5.2<=14.1.5.6
3
F5 BIG-IP APM=13.1.5.1
3
F5 APM Clients>=7.2.3<=7.2.4
7.2.4.6
F5 F5 Access for iOS>=3.0.13<=3.0.14
F5 F5 Access for macOS>=2.0.2<=2.0.3
F5 F5 Access for Windows>=1.2<=1.3
Event History
Sep 27, 2023
Advisory Published
via F5·02:05 PM
CVE Published
via MITRE·03:21 PM
Data Sourced
via MITRE·03:21 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-43124?
CVE-2023-43124 is a vulnerability in BIG-IP APM clients that allows them to send IP traffic outside of the VPN tunnel.
2
What is the severity of CVE-2023-43124?
CVE-2023-43124 has a severity rating of 7.1 (high).
3
Which software versions are affected by CVE-2023-43124?
Software versions 14.1.5.2 to 14.1.5.6, 15.1.8 to 15.1.10, 16.1.3.3 to 16.1.4, 13.1.5.1, and 17.1.0 of F5 Big-ip Access Policy Manager are affected by CVE-2023-43124.
4
How can I fix CVE-2023-43124?
To fix CVE-2023-43124, update to a version of F5 Big-ip Access Policy Manager that is not affected by the vulnerability.
5
Where can I find more information about CVE-2023-43124?
You can find more information about CVE-2023-43124 at the following link: [Reference](https://my.f5.com/manage/s/article/K000136907)