Description
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
F5 BIG-IP
Default version status: unknown
21.1.0 to < Hotfix-BIGIP-21.1.0.2.0.30.22-ENGaffected17.5.0 to < Hotfix-BIGIP-17.5.1.9.0.160.12-ENGaffected17.1.0 to < Hotfix-BIGIP-17.1.3.5.0.41.14-ENGaffected