Vulnerabilities > CVE-2020-5929 - Information Exposure Through Discrepancy vulnerability in F5 products

CVSS 5.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

high complexity

CWE-203

NVD

Published: 2020-09-25

Updated: 2021-07-21

Summary

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	F5 F5 BIG IP Local Traffic Manager 11.6.2 F5 BIG IP Local Traffic Manager 12.1.2 F5 BIG IP Local Traffic Manager 11.6.1 F5 BIG IP Local Traffic Manager 13.0.0 F5 BIG IP Local Traffic Manager 12.1.0 F5 BIG IP Local Traffic Manager 12.1.1 F5 BIG IP Application Acceleration Manager 13.0.0 F5 BIG IP Application Acceleration Manager 12.1.2 F5 BIG IP Application Acceleration Manager 12.1.0 F5 BIG IP Application Acceleration Manager 12.1.1 F5 BIG IP Application Acceleration Manager 11.6.2 F5 BIG IP Application Acceleration Manager 11.6.1 F5 BIG IP Advanced WEB Application Firewall 13.0.0 F5 BIG IP Advanced WEB Application Firewall 12.1.2 F5 BIG IP Advanced WEB Application Firewall 12.1.0 F5 BIG IP Advanced WEB Application Firewall 12.1.1 F5 BIG IP Advanced WEB Application Firewall 11.6.2 F5 BIG IP Advanced WEB Application Firewall 11.6.1 F5 BIG IP Advanced Firewall Manager 13.0.0 F5 BIG IP Advanced Firewall Manager 12.1.2 F5 BIG IP Advanced Firewall Manager 12.1.0 F5 BIG IP Advanced Firewall Manager 12.1.1 F5 BIG IP Advanced Firewall Manager 11.6.2 F5 BIG IP Advanced Firewall Manager 11.6.1 F5 BIG IP Analytics 12.1.2 F5 BIG IP Analytics 13.0.0 F5 BIG IP Analytics 12.1.0 F5 BIG IP Analytics 12.1.1 F5 BIG IP Analytics 11.6.2 F5 BIG IP Analytics 11.6.1 F5 BIG IP Access Policy Manager 12.1.2 F5 BIG IP Access Policy Manager 13.0.0 F5 BIG IP Access Policy Manager 11.6.2 F5 BIG IP Access Policy Manager 12.1.0 F5 BIG IP Access Policy Manager 12.1.1 F5 BIG IP Access Policy Manager 11.6.1 F5 BIG IP Application Security Manager 12.1.2 F5 BIG IP Application Security Manager 13.0.0 F5 BIG IP Application Security Manager 12.1.0 F5 BIG IP Application Security Manager 12.1.1 F5 BIG IP Application Security Manager 11.6.2 F5 BIG IP Application Security Manager 11.6.1 F5 BIG IP Ddos Hybrid Defender 12.1.2 F5 BIG IP Ddos Hybrid Defender 13.0.0 F5 BIG IP Ddos Hybrid Defender 12.1.0 F5 BIG IP Ddos Hybrid Defender 11.6.2 F5 BIG IP Ddos Hybrid Defender 11.6.1 F5 BIG IP Domain Name System 12.1.2 F5 BIG IP Domain Name System 13.0.0 F5 BIG IP Domain Name System 12.1.0 F5 BIG IP Domain Name System 12.1.1 F5 BIG IP Domain Name System 11.6.2 F5 BIG IP Domain Name System 11.6.1 F5 BIG IP Fraud Protection Service 12.1.2 F5 BIG IP Fraud Protection Service 13.0.0 F5 BIG IP Fraud Protection Service 12.1.0 F5 BIG IP Fraud Protection Service 12.1.1 F5 BIG IP Fraud Protection Service 11.6.2 F5 BIG IP Fraud Protection Service 11.6.1 F5 BIG IP Global Traffic Manager 12.1.2 F5 BIG IP Global Traffic Manager 13.0.0 F5 BIG IP Global Traffic Manager 12.1.0 F5 BIG IP Global Traffic Manager 12.1.1 F5 BIG IP Global Traffic Manager 11.6.2 F5 BIG IP Global Traffic Manager 11.6.1 F5 BIG IP Link Controller 12.1.2 F5 BIG IP Link Controller 13.0.0 F5 BIG IP Link Controller 12.1.0 F5 BIG IP Link Controller 12.1.1 F5 BIG IP Link Controller 11.6.2 F5 BIG IP Link Controller 11.6.1 F5 BIG IP Policy Enforcement Manager 12.1.2 F5 BIG IP Policy Enforcement Manager 13.0.0 F5 BIG IP Policy Enforcement Manager 12.1.0 F5 BIG IP Policy Enforcement Manager 12.1.1 F5 BIG IP Policy Enforcement Manager 11.6.2 F5 BIG IP Policy Enforcement Manager 11.6.1 F5 SSL Orchestrator 12.1.2 F5 SSL Orchestrator 13.0.0 F5 SSL Orchestrator 12.1.0 F5 SSL Orchestrator 11.6.1 F5 SSL Orchestrator 11.6.2	135

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

References

https://support.f5.com/csp/article/K91158923