CVE-2019-6682

published 2019-12-23

CVE-2019-6682: On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulnerability is only known to affect resource-constrained systems in which the security policy is configured with response-side features, such as Data Guard or response-side learning.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip_application_security_manager	11.5.2 – 11.6.5	—
f5	big-ip_application_security_manager	12.1.0 – 12.1.5	—
f5	big-ip_application_security_manager	>= 13.1.0 < 13.1.3.2	13.1.3.2
f5	big-ip_application_security_manager	>= 14.1.0 < 14.1.2.3	14.1.2.3
f5	big-ip_application_security_manager	>= 15.0.0 < 15.1.0	15.1.0
f5	big-ip_asm	—	—
f5	big-ip_asm	—	—
f5	big-ip_asm	—	—
f5	big-ip_asm	—	—
f5	big-ip_asm	—	—
f5	big-ip_asm	—	—

CWE-400