F5-K000135555: Low severity F5 BIG-IP vulnerability

Q: What is the severity of F5-K000135555?

F5-K000135555 is classified as a vulnerability that is difficult to exploit but still poses significant risk to affected versions of Java SE.

Q: How do I fix F5-K000135555?

To mitigate F5-K000135555, you should update to the latest patched versions of Java SE or ensure that your F5 BIG-IP and BIG-IQ Centralized Management products are updated accordingly.

Q: What versions are affected by F5-K000135555?

F5-K000135555 affects specific versions of Java SE, including 7u251, 8u241, 11.0.6, 14, and corresponding versions of F5 BIG-IP and BIG-IQ Centralized Management.

Q: Who can exploit F5-K000135555?

F5-K000135555 can potentially be exploited by unauthenticated attackers with network access under certain conditions.

Q: Is F5-K000135555 specific to any F5 product?

Yes, F5-K000135555 specifically affects certain versions of F5 BIG-IP and BIG-IQ Centralized Management.

Published Jul 24, 2023

Updated

CVE-2020-2756 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2020-2757 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected Software

6 affected components

F5 BIG-IP>=17.5.0<=17.5.1, >=17.0.0<=17.1.3

F5 BIG-IP>=16.1.0<=16.1.6

F5 BIG-IP>=15.1.0<=15.1.10

F5 BIG-IP>=14.1.0<=14.1.5

F5 BIG-IP>=13.1.0<=13.1.5

F5 BIG-IQ Centralized Management>=8.0.0<=8.4.0

Event History

Jul 24, 2023

Advisory Published

via F5·06:40 PM

Frequently Asked Questions

What is the severity of F5-K000135555?

F5-K000135555 is classified as a vulnerability that is difficult to exploit but still poses significant risk to affected versions of Java SE.

How do I fix F5-K000135555?

To mitigate F5-K000135555, you should update to the latest patched versions of Java SE or ensure that your F5 BIG-IP and BIG-IQ Centralized Management products are updated accordingly.

What versions are affected by F5-K000135555?

F5-K000135555 affects specific versions of Java SE, including 7u251, 8u241, 11.0.6, 14, and corresponding versions of F5 BIG-IP and BIG-IQ Centralized Management.

Who can exploit F5-K000135555?