F5-K000140505: Medium severity f5 f5os vulnerability

Q: What is the severity of F5-K000140505?

The severity of F5-K000140505 is considered critical due to the potential for authentication bypass.

Q: How do I fix F5-K000140505?

To fix F5-K000140505, users should upgrade to Apache HTTP Server version 2.4.60 or later.

Q: Which versions are affected by F5-K000140505?

F5-K000140505 affects Apache HTTP Server versions 2.4.59 and earlier, along with specific versions of F5OS-A, F5OS-C, and Traffix SDC.

Q: What vulnerability does F5-K000140505 address?

F5-K000140505 addresses an encoding issue in mod_proxy that allows malformed request URLs to bypass authentication.

Q: Is there a workaround for F5-K000140505?

There is no specific workaround for F5-K000140505; upgrading to the patched version is recommended.

Published Aug 3, 2024

Updated

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Affected Software

3 affected components

F5 F5OS-A=1.7.0, >=1.5.1<=1.5.2

F5 F5OS-C>=1.6.0<=1.6.2

F5 Traffix SDC=5.2.0, =5.1.0

Event History

Aug 3, 2024

Advisory Published

via F5·03:46 AM

Frequently Asked Questions

What is the severity of F5-K000140505?

The severity of F5-K000140505 is considered critical due to the potential for authentication bypass.

How do I fix F5-K000140505?

To fix F5-K000140505, users should upgrade to Apache HTTP Server version 2.4.60 or later.

Which versions are affected by F5-K000140505?

F5-K000140505 affects Apache HTTP Server versions 2.4.59 and earlier, along with specific versions of F5OS-A, F5OS-C, and Traffix SDC.

What vulnerability does F5-K000140505 address?

F5-K000140505 addresses an encoding issue in mod_proxy that allows malformed request URLs to bypass authentication.

Is there a workaround for F5-K000140505?