F5 security advisories, October 2023

Every F5 security advisory published in October 2023, from F5 SIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 17
Critical: 2
High: 10
In CISA KEV: 2
CVEs: 18

F5 advisories published in October 2023

Oct 26, 2023
Critical [CVE-2023-46747] Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP…
Critical9.8ExploitedCISA KEV
Oct 26, 2023
High [CVE-2023-46748] authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may
High8.8ExploitedCISA KEV
Oct 10, 2023
Critical [CVE-2023-41373] directory traversal vulnerability exists in the BIG-IP Configuration Utility that may
Critical9.9
Oct 10, 2023
High [CVE-2023-5450] insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may
High7.3
Oct 10, 2023
High [CVE-2023-45226] The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials
High7.4
Oct 10, 2023
High [CVE-2023-43746] BIG-IP: When running in Appliance mode, an authenticated user assigned the Administrator role
High8.7
Oct 10, 2023
High [CVE-2023-38418 +1] The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process
High7.8
Oct 10, 2023
High [CVE-2023-42768] BIG-IP: When a non-admin user has been assigned an administrator role
High7.2
Oct 10, 2023
High [CVE-2023-41085] When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.
High7.5
Oct 10, 2023
High [CVE-2023-40542] When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests
High7.5
Oct 10, 2023
High [CVE-2023-40537] BIG-IP: authenticated user's session cookie
High8.1
Oct 10, 2023
High [CVE-2023-40534] When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the…
High7.5
Oct 10, 2023
Medium [CVE-2023-45219] Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may
Medium4.4
Oct 10, 2023
Medium [CVE-2023-43485] When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log
Medium5.5
Oct 10, 2023
Medium [CVE-2023-41964] BIG-IP: The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.
Medium4.3
Oct 10, 2023
Medium [CVE-2023-41253] When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the…
Medium5.5
Oct 10, 2023
Medium [CVE-2023-39447] BIG-IP: When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.
Medium4.4

Get an email when F5 publishes the next one.

See F5's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about F5

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.