F5-K000132643: Medium severity f5 big-ip and big-iq centralized management vulnerability

Q: What is the severity of F5-K000132643?

The severity of F5-K000132643 is critical, as it allows attackers to smuggle requests to the AJP server.

Q: How do I fix F5-K000132643?

To fix F5-K000132643, upgrade to the latest patched version of Apache HTTP Server and ensure F5 BIG-IP firmware is updated to the recommended remedy versions.

Q: What versions are affected by F5-K000132643?

F5-K000132643 affects Apache HTTP Server versions 2.4.54 and earlier, along with certain versions of F5 BIG-IP and F5OS.

Q: Can F5-K000132643 be exploited remotely?

Yes, F5-K000132643 can be exploited remotely by an attacker who can craft malicious HTTP requests.

Q: What products are impacted by F5-K000132643?

Products impacted by F5-K000132643 include F5 BIG-IP, F5 BIG-IQ Centralized Management, and multiple versions of F5OS.

Published Feb 22, 2023

Updated

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

Affected Software

7 affected componentsFixes available

F5 BIG-IP>=17.0.0<=17.1.1

17.1.1.1

F5 BIG-IP=16.1.0

16.1.4.2

F5 BIG-IP=15.1.0

15.1.10.3

F5 BIG-IP=14.1.0

F5 BIG-IP>=13.1.0<=13.1.5

F5 F5OS-A>=1.5.0<=1.5.1, =1.4.0, >=1.3.0<=1.3.2

F5 F5OS-C>=1.6.0<=1.6.2, >=1.5.0<=1.5.1, >=1.3.0<=1.3.2

Event History

Feb 22, 2023

Advisory Published

via F5·01:06 AM

Frequently Asked Questions

What is the severity of F5-K000132643?

The severity of F5-K000132643 is critical, as it allows attackers to smuggle requests to the AJP server.

How do I fix F5-K000132643?

To fix F5-K000132643, upgrade to the latest patched version of Apache HTTP Server and ensure F5 BIG-IP firmware is updated to the recommended remedy versions.

What versions are affected by F5-K000132643?