F5 security advisories, March 2021

Every F5 security advisory published in March 2021, from F5 SIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 22
Critical: 6
High: 10
In CISA KEV: 2
CVEs: 23

F5 advisories published in March 2021

Mar 31, 2021
Critical [CVE-2021-23005] BIG-IQ: On all 7.x and 6.x versions (fixed in 8.0.0)
Critical9.1
Mar 31, 2021
Critical [CVE-2021-22991] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x…
Critical9.8ExploitedCISA KEV
Mar 31, 2021
Critical [CVE-2021-22992] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Critical9.8
Mar 31, 2021
Critical [CVE-2021-22989] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Critical9.1
Mar 31, 2021
Critical [CVE-2021-22987] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Critical9.9
Mar 31, 2021
Critical [CVE-2021-22986] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x…
Critical9.8ExploitedCISA KEV
Mar 31, 2021
High [CVE-2021-23004] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before…
High7.5
Mar 31, 2021
High [CVE-2021-23003] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before…
High7.5
Mar 31, 2021
High [CVE-2021-23000] On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or…
High7.5
Mar 31, 2021
High [CVE-2021-22999] On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to…
High7.5
Mar 31, 2021
High [CVE-2021-22997] On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for…
High7.5
Mar 31, 2021
High [CVE-2021-22996] BIG-IQ: On all 7.x versions (fixed in 8.0.0)
High7.5
Mar 31, 2021
High [CVE-2021-22993] On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x…
High8.8
Mar 31, 2021
High [CVE-2021-22995] On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA)
High7.5
Mar 31, 2021
High [CVE-2021-22990] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
High7.2
Mar 31, 2021
High [CVE-2021-22988] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
High8.8
Mar 31, 2021
Medium [CVE-2021-23007] On BIG-IP versions 14.1.4 and 16.0.1.1
Medium5.3
Mar 31, 2021
Medium [CVE-2021-23006] On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability
Medium6.1
Mar 31, 2021
Medium [CVE-2021-23002] When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all…
Medium4.5
Mar 31, 2021
Medium [CVE-2021-23001] BIG-IP: On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Medium4.3
Mar 31, 2021
Medium [CVE-2021-22998] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Medium5.3
Mar 31, 2021
Medium [CVE-2020-5948 +1] On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before…
Medium6.1

Get an email when F5 publishes the next one.

See F5's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about F5

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.