imPC@ndo IT

Tracker / CVE-2018-5524

CVE-2018-5524

Medium 5.3

Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module (HSM) functionality are exposed and impacted by this issue.

Affected products and versions

f5 big-ip_access_policy_manager · 11.6.1 → 11.6.3
f5 big-ip_access_policy_manager · 12.1.0 → 12.1.3
f5 big-ip_access_policy_manager · 13.0.0 → 13.0.1
f5 big-ip_advanced_firewall_manager · 11.6.1 → 11.6.3
f5 big-ip_advanced_firewall_manager · 12.1.0 → 12.1.3
f5 big-ip_advanced_firewall_manager · 13.0.0 → 13.0.1
f5 big-ip_analytics · 11.6.1 → 11.6.3
f5 big-ip_analytics · 12.1.0 → 12.1.3
f5 big-ip_analytics · 13.0.0 → 13.0.1
f5 big-ip_application_acceleration_manager · 11.6.1 → 11.6.3
f5 big-ip_application_acceleration_manager · 12.1.0 → 12.1.3
f5 big-ip_application_acceleration_manager · 13.0.0 → 13.0.1
f5 big-ip_application_security_manager · 11.6.1 → 11.6.3
f5 big-ip_application_security_manager · 12.1.0 → 12.1.3
f5 big-ip_application_security_manager · 13.0.0 → 13.0.1
f5 big-ip_edge_gateway · 11.6.1 → 11.6.3
f5 big-ip_edge_gateway · 12.1.0 → 12.1.3
f5 big-ip_edge_gateway · 13.0.0 → 13.0.1
f5 big-ip_fraud_protection_service · 11.6.1 → 11.6.3
f5 big-ip_fraud_protection_service · 12.1.0 → 12.1.3
f5 big-ip_fraud_protection_service · 13.0.0 → 13.0.1
f5 big-ip_link_controller · 11.6.1 → 11.6.3
f5 big-ip_link_controller · 12.1.0 → 12.1.3
f5 big-ip_link_controller · 13.0.0 → 13.0.1
f5 big-ip_local_traffic_manager · 11.6.1 → 11.6.3
f5 big-ip_local_traffic_manager · 12.1.0 → 12.1.3
f5 big-ip_local_traffic_manager · 13.0.0 → 13.0.1
f5 big-ip_policy_enforcement_manager · 11.6.1 → 11.6.3
f5 big-ip_policy_enforcement_manager · 12.1.0 → 12.1.3
f5 big-ip_policy_enforcement_manager · 13.0.0 → 13.0.1
f5 big-ip_webaccelerator · 11.6.1 → 11.6.3
f5 big-ip_webaccelerator · 12.1.0 → 12.1.3
f5 big-ip_webaccelerator · 13.0.0 → 13.0.1

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References