CVE-2020-5929
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD
Description
In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.
Affected (112)
Products: F5: Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Advanced Web Application Firewall, Big Ip Analytics, Big Ip Application Acceleration Manager, Big Ip Application Security Manager, Big Ip Ddos Hybrid Defender, Big Ip Domain Name System, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Policy Enforcement Manager, Ssl Orchestrator
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 | |
| From 11.6.1 to 11.6.2 |
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.