Security and application delivery solutions provider F5 has released its quarterly security notification for August 2022, which informs customers about 21 vulnerabilities affecting BIG-IP and other products.
The company has released separate advisories for a dozen high-severity vulnerabilities, as well as eight medium-severity and one low-severity flaws.
The high-severity issues can be exploited to bypass security restrictions, execute arbitrary system commands, cause a denial of service (DoS) condition, and escalate privileges.
More than half, particularly the DoS flaws, can be exploited remotely without authentication. Several of these vulnerabilities are related to the Traffic Management Microkernel (TMM) component.
The medium-severity bugs can lead to DoS, information disclosure, traffic interception, and security bypass, but most of them require authentication and network access.
A vast majority of the vulnerabilities were discovered internally by F5. While there is no indication that any of these security holes have been exploited in the wild, the patches should not be ignored considering that threat actors have been known to target vulnerabilities affecting BIG-IP products.
The US Cybersecurity and Infrastructure Security Agency (CISA) has advised organizations to review the advisories from F5 and install the updates.
F5’s previous quarterly security notification informed customers about more than 50 vulnerabilities, including one critical issue. The latest round of fixes does not address any critical flaws.
F5’s next quarterly security notification is scheduled for October 19. The dates of these notifications are known in advance so that customers can schedule the necessary updates.
Related: F5 Patches Two Dozen Vulnerabilities in BIG-IP
Related: Vulnerability Exposes F5 BIG-IP Systems to Remote DoS Attacks
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
Latest News
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
- Sysdig Introduces CNAPP With Realtime CDR
- Stay Focused on What’s Important
