CVE-2021-23007 — F5 Big-ip Global Traffic Manager vulnerability

4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.7%
top 27.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Advanced WEB Application Firewall+13 more
Timeline
PublishedMar 31
Latest updateMay 24

Description

On BIG-IP versions 14.1.4 and 16.0.1.1, when the Traffic Management Microkernel (TMM) process handles certain undisclosed traffic, it may start dropping all fragmented IP traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages17 packages

▶NVDf5/big-ip_local_traffic_manager14.1.4, 16.0.1.1+1
▶NVDf5/big-ip_global_traffic_manager14.1.4, 16.0.1.1+1
▶NVDf5/big-ip_analytics14.1.4, 16.0.1.1+1
▶NVDf5/big-ip_edge_gateway14.1.4, 16.0.1.1+1
▶NVDf5/big-ip_webaccelerator14.1.4, 16.0.1.1+1

Patches

Patch: support.f5.com ↗Patch: support.f5.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4g5c-cjq7-xrqv: On BIG-IP versions 14↗2022-05-24
▶
CVEList
CVE-2021-23007: On BIG-IP versions 14↗2021-03-31
▶

📋Vendor Advisories

1
F5
CVE-2021-23007: On BIG-IP versions 14↗2021-03-31
▶
CVE-2021-23007 — F5 vulnerability | cvebase