CVE-2022-34862

EUVD-2022-37768
In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
f5CNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
f5big-ip_access_policy_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_access_policy_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_access_policy_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_access_policy_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_advanced_firewall_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_advanced_firewall_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_advanced_firewall_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_advanced_firewall_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_analytics
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_analytics
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_analytics
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_analytics
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_application_acceleration_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_application_acceleration_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_application_acceleration_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_application_acceleration_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_application_security_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_application_security_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_application_security_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_application_security_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_domain_name_system
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_domain_name_system
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_domain_name_system
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_domain_name_system
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_fraud_protection_service
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_fraud_protection_service
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_fraud_protection_service
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_fraud_protection_service
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_global_traffic_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_global_traffic_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_global_traffic_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_global_traffic_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_link_controller
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_link_controller
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_link_controller
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_link_controller
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_local_traffic_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_local_traffic_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_local_traffic_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_local_traffic_manager
16.1.0 ≤
𝑥
< 16.1.3.1
f5big-ip_policy_enforcement_manager
13.1.0 ≤
𝑥
≤ 13.1.5
f5big-ip_policy_enforcement_manager
14.1.0 ≤
𝑥
< 14.1.5
f5big-ip_policy_enforcement_manager
15.1.0 ≤
𝑥
< 15.1.6.1
f5big-ip_policy_enforcement_manager
16.1.0 ≤
𝑥
< 16.1.3.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.f5.com/csp/article/K66510514
https://support.f5.com/csp/article/K66510514