CVE-2018-5508 - Vulnerability Details - OpenCVE

On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when processing compressed data though a Virtual Server with an associated PEM profile using the content insertion option.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00647.

Key SSVC decision points have not yet been added.

Vendors	Products
F5	Big-ip Policy Enforcement Manager

Configuration 1 [-]

OR	cpe:2.3:a:f5:big-ip_policy_enforcement_manager::::::::
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager::::::::
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager::::::::
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager:13.0.0:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2018-17277	On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when processing compressed data though a Virtual Server with an associated PEM profile using the content insertion option.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support.f5.com/csp/article/K10329515

History

No history.

MITRE

Status: PUBLISHED

Assigner: f5

Published: 2018-04-13T13:00:00Z

Updated: 2024-09-17T04:09:05.643Z

Reserved: 2018-01-12T00:00:00

Link: CVE-2018-5508

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-04-13T13:29:00.737

Modified: 2024-11-21T04:08:57.010

Link: CVE-2018-5508

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "BIG-IP (PEM)", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "13.0.0"}, {"status": "affected", "version": "12.0.0-12.1.3.1"}, {"status": "affected", "version": "11.6.0-11.6.2"}, {"status": "affected", "version": "11.5.1-11.5.5"}, {"status": "affected", "version": "11.2.1"}]}], "datePublic": "2018-04-12T00:00:00", "descriptions": [{"lang": "en", "value": "On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when processing compressed data though a Virtual Server with an associated PEM profile using the content insertion option."}], "problemTypes": [{"descriptions": [{"description": "DoS", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-13T12:57:01", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K10329515"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "f5sirt@f5.com", "DATE_PUBLIC": "2018-04-12T00:00:00", "ID": "CVE-2018-5508", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "BIG-IP (PEM)", "version": {"version_data": [{"version_value": "13.0.0"}, {"version_value": "12.0.0-12.1.3.1"}, {"version_value": "11.6.0-11.6.2"}, {"version_value": "11.5.1-11.5.5"}, {"version_value": "11.2.1"}]}}]}, "vendor_name": "F5 Networks, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when processing compressed data though a Virtual Server with an associated PEM profile using the content insertion option."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DoS"}]}]}, "references": {"reference_data": [{"name": "https://support.f5.com/csp/article/K10329515", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K10329515"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:40:50.673Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K10329515"}]}]}, "cveMetadata": {"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2018-5508", "datePublished": "2018-04-13T13:00:00Z", "dateReserved": "2018-01-12T00:00:00", "dateUpdated": "2024-09-17T04:09:05.643Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "573B289C-DFB1-4AE0-A792-0F591D407200", "versionEndIncluding": "11.5.5", "versionStartIncluding": "11.5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B532993-358F-442B-936E-F02B5667AB50", "versionEndIncluding": "11.6.2", "versionStartIncluding": "11.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C9CDAFA-2B51-4815-9857-694187C27779", "versionEndIncluding": "12.1.3", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "D964BBB4-B343-43C6-A7A1-39BD9E1EEA16", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "42821916-E601-4831-B37B-3202ACF2C562", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TMM may crash when processing compressed data though a Virtual Server with an associated PEM profile using the content insertion option."}, {"lang": "es", "value": "En F5 BIG-IP PEM, en su versi\u00f3n 13.0.0, de la versi\u00f3n 12.0.0 a la 12.1.3.1, de la versi\u00f3n 11.6.0 a la 11.6.2, de la versi\u00f3n 11.5.1 a la 11.5.5 o en su versi\u00f3n 11.2.1, bajo ciertas condiciones, TMM podr\u00eda cerrarse inesperadamente al procesar datos comprimidos mediante un servidor virtual con un perfil PEM asociado a trav\u00e9s de la opci\u00f3n de inserci\u00f3n de contenidos."}], "id": "CVE-2018-5508", "lastModified": "2024-11-21T04:08:57.010", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-13T13:29:00.737", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K10329515"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K10329515"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}