SB2021021108 - Multiple vulnerabilities in BIG-IP TMM

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2021-22977)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing communication between malicious HTTP client code and a malicious server. A remote attacker can pass specially crafted input to the application and force the Traffic Management Microkernel (TMM) to restart.

2) Resource exhaustion (CVE-ID: CVE-2021-22975)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and force the Traffic Management Microkernel (TMM) module to restart.

Remediation

Install update from vendor's website.

References

• https://support.f5.com/csp/article/K14693346
• https://support.f5.com/csp/article/K21971977