On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.
2020-04-30T20:15:12.480
2024-11-21T05:34:44.380
Modified
CVSSv3.1: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:N/I:N/A:P
10.0
2.9
Type | Vendor | Product | Version/Range | Vulnerable? |
---|---|---|---|---|
Application | f5 | big-ip_access_policy_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_advanced_firewall_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_analytics | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_application_acceleration_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_application_security_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_domain_name_system | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_fraud_protection_service | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_global_traffic_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_link_controller | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_local_traffic_manager | ≤ 14.1.2.3 | Yes |
Application | f5 | big-ip_policy_enforcement_manager | ≤ 14.1.2.3 | Yes |