Security and application delivery solutions provider F5 has released its quarterly security notification for August 2022, which informs customers about 21 vulnerabilities affecting BIG-IP and other products.
The company has released separate advisories for a dozen high-severity vulnerabilities, as well as eight medium-severity and one low-severity flaws.
The high-severity issues can be exploited to bypass security restrictions, execute arbitrary system commands, cause a denial of service (DoS) condition, and escalate privileges.
More than half, particularly the DoS flaws, can be exploited remotely without authentication. Several of these vulnerabilities are related to the Traffic Management Microkernel (TMM) component.
The medium-severity bugs can lead to DoS, information disclosure, traffic interception, and security bypass, but most of them require authentication and network access.
A vast majority of the vulnerabilities were discovered internally by F5. While there is no indication that any of these security holes have been exploited in the wild, the patches should not be ignored considering that threat actors have been known to target vulnerabilities affecting BIG-IP products.
The US Cybersecurity and Infrastructure Security Agency (CISA) has advised organizations to review the advisories from F5 and install the updates.
F5’s previous quarterly security notification informed customers about more than 50 vulnerabilities, including one critical issue. The latest round of fixes does not address any critical flaws.
F5’s next quarterly security notification is scheduled for October 19. The dates of these notifications are known in advance so that customers can schedule the necessary updates.
Related: F5 Patches Two Dozen Vulnerabilities in BIG-IP
Related: Vulnerability Exposes F5 BIG-IP Systems to Remote DoS Attacks