NetSight
IP …
medium5.5

CVE-2019-6632

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are…

Impact

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are encrypted because the vCMP configuration unit key is generated with insufficient randomness. The attack prerequisite is direct access to encrypted configuration and/or UCS files.

Affected products

VendorProductAffected versions
F5Big-Ip Local Traffic Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Application Acceleration Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Advanced Firewall Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Analytics
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Access Policy Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Application Security Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Domain Name System
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Edge Gateway
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Global Traffic Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Link Controller
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Policy Enforcement Manager
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6
F5Big-Ip Webaccelerator
from 12.1.0 before 12.1.4.1
from 13.0.0 before 13.1.1.5
from 14.0.0 before 14.0.0.5
from 14.1.0 before 14.1.0.6

Weakness classification

CWE-330

References