CVSS: 7.5EPSS: 0%CPEs: 56EXPL: 0CVE-2022-23025
https://notcve.org/view.php?id=CVE-2022-23025
On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.1, 15.1.x anteriores a 15.1.4, 14.1.x anteriores a 14.1.4.4 y todas las versiones de la 13.1.x, cuando es configurado un perfil SIP ALG en un servidor virtual, las peticiones no reveladas pueden causar una terminación del Microkernel de Administración del Tráfico (TMM). Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K44110411 • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 72EXPL: 0CVE-2022-23023
https://notcve.org/view.php?id=CVE-2022-23023
On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.1.x anteriores a 16.1.2.1, 15.1.x anteriores a 15.1.5, 14.1.x anteriores a 14.1.4.5, y todas las versiones de 13.1.x y 12.1.x, y BIG-IQ todas las versiones de 8.x y 7.x, las peticiones no reveladas por un usuario autenticado de iControl REST pueden causar un aumento en el uso de recursos de memoria. Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K11742742 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2022-23026
https://notcve.org/view.php?id=CVE-2022-23026
On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP ASM & Advanced WAF versión 16.1.x anteriores a 16.1.2, 15.1.x anteriores a 15.1.4.1, 14.1.x anteriores a 14.1.4.5, y todas las versiones de 13.1.x y 12.1.x, un usuario autenticado con bajos privilegios, como un invitado, puede cargar datos usando un endpoint REST no revelado causando un aumento en el uso de recursos del disco. Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K08402414 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 1%CPEs: 60EXPL: 1CVE-2002-20001
https://notcve.org/view.php?id=CVE-2002-20001
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE. El Protocolo de Acuerdo de Claves Diffie-Hellman permite a atacantes remotos (del lado del cliente) enviar números arbitrarios que en realidad no son claves públicas, y desencadenar costosos cálculos de exponenciación modular DHE del lado del servidor, también se conoce como un ataque D(HE)ater. • https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf https://dheatattack.com https://dheatattack.gitlab.io https://github.com/Balasys/dheater https://github.com/mozilla/ssl-config-generator/issues/162 https://gitlab.com/dheatattack/dheater https://ieeexplore.ieee.org/document/10374117 https://support.f5.com/csp/article/K83120834 https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration https: • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23029
https://notcve.org/view.php?id=CVE-2021-23029
On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En versiones 16.0.x anteriores a 16.0.1.2, unas comprobaciones de permisos insuficientes pueden permitir a usuarios autenticados con privilegios de invitado llevar a cabo ataques de tipo Server-Side Request Forgery (SSRF) mediante F5 Advanced Web Application Firewall (WAF) y la utilidad BIG-IP ASM Configuration. Nota: Las versiones de software que han alcanzado el Final del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K52420610 • CWE-918: Server-Side Request Forgery (SSRF) •