First published: Tue Feb 28 2023(Updated: )
The original TLS protocol includes a weakness in master secret negotiation, potentially allowing the Triple Handshake Attack that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627.
Affected Software | Affected Version | How to fix |
---|---|---|
F5 BIG-IP and BIG-IQ Centralized Management | >=17.0.0<=17.1.2 | 17.5.0 |
F5 BIG-IP and BIG-IQ Centralized Management | >=16.1.0<=16.1.5 | |
F5 BIG-IP and BIG-IQ Centralized Management | >=15.1.0<=15.1.10 | |
F5 BIG-IP and BIG-IQ Centralized Management | >=14.1.0<=14.1.5 | |
F5 BIG-IP and BIG-IQ Centralized Management | >=13.1.0<=13.1.5 | |
F5 BIG-IP and BIG-IQ Centralized Management | >=8.0.0<=8.3.0 | |
F5 BIG-IP and BIG-IQ Centralized Management | =7.1.0 | |
F5 F5OS | >=1.3.0<=1.3.2 | |
F5 F5OS | >=1.5.0<=1.5.1>=1.3.0<=1.3.2 | |
F5 Traffix Systems Signaling Delivery Controller | =5.1.0 | 5.2.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
F5-K000132686 is classified as a medium severity vulnerability due to the potential for a Triple Handshake Attack.
To mitigate F5-K000132686, upgrade to the specified versions that include the Extended Master Secret extension.
F5-K000132686 affects multiple versions of F5 BIG-IP, BIG-IQ Centralized Management, and F5OS products.
Yes, F5-K000132686 can be exploited remotely if the vulnerable TLS protocol is in use.
The main weakness in F5-K000132686 is a flaw in master secret negotiation in the original TLS protocol.