描述:
F5 发布了安全公告,以应对 F5 产品的多个漏洞。有关漏洞资料的详情,请参考以下网址:
https://my.f5.com/manage/s/article/K000159076
https://my.f5.com/manage/s/article/K000159824
https://my.f5.com/manage/s/article/K10812540
https://my.f5.com/manage/s/article/K16729408
https://my.f5.com/manage/s/article/K19559038
https://my.f5.com/manage/s/article/K21054458
https://my.f5.com/manage/s/article/K48073202
https://my.f5.com/manage/s/article/K49419538
https://my.f5.com/manage/s/article/K50310001
https://my.f5.com/manage/s/article/K52379673
https://my.f5.com/manage/s/article/K53225395
https://my.f5.com/manage/s/article/K54724312
https://my.f5.com/manage/s/article/K57542514
https://my.f5.com/manage/s/article/K61186963
https://my.f5.com/manage/s/article/K64119434
https://my.f5.com/manage/s/article/K67090077
https://my.f5.com/manage/s/article/K68652018
https://my.f5.com/manage/s/article/K77326807
https://my.f5.com/manage/s/article/K78284681
受影响的系统:
APM Clients 版本 7.1.5 至 7.1.9, 7.2.1
BIG-IP (所有模组) 版本 11.6.1 至 11.6.5, 12.1.0 至 12.1.6, 13.1.0 至 13.1.5, 14.1.0 至 14.1.5, 15.1.0 至 15.1.10, 16.0.0 至 16.1.6, 17.0.0 至 17.1.3, 17.5.0 至 17.5.1, 21.0.0
BIG-IP Advanced WAF/ASM 版本 17.1.0 至 17.1.2
BIG-IQ Centralized Management 版本 5.2.0 至 5.4.0, 6.0.0 至 6.1.0, 7.0.0 至 7.1.0, 8.0.0 至 8.4.0
Enterprise Manager 版本 3.1.1
F5 iWorkflow 版本 2.3.0
F5OS 版本 1.0.0 至 1.1.4
F5OS-A 版本 1.0.0 至 1.0.1, 1.1.0 至 1.1.1, 1.2.0, 1.3.0 至 1.3.2, 1.5.0 至 1.5.4, 1.7.0, 1.8.0 至 1.8.3
F5OS-C 版本 1.1.0 至 1.1.4, 1.2.0 至 1.2.2, 1.3.0 至 1.3.2, 1.5.0 至 1.5.1, 1.6.0 至 1.6.4, 1.8.0 至 1.8.2
NGINX Gateway Fabric 版本 1.2.0 至 1.6.2, 2.0.0 至 2.4.0
NGINX Ingress Controller 版本 3.4.0 至 3.7.2, 4.0.0 至 4.0.1, 5.0.0 至 5.3.2
NGINX Instance Manager 版本 2.15.1 至 2.21.0
NGINX Open Source 版本 1.3.0 至 1.29.4
NGINX Plus 版本 R32 至 R36 P1
Traffix SDC 版本 5.0.0 至 5.1.0, 5.2.0
影响:
成功利用漏洞可以导致受影响的系统发生远端执行程式码、服务被拒绝、权限提升、泄漏资讯、绕过保安限制或篡改。
建议:
现已有适用于受影响系统的软件更新。受影响系统的系统管理员应遵从产品供应商的建议,立即採取行动以降低风险。建议谘询产品供应商以取得修补程式及有关支援。
进一步资讯:
- https://my.f5.com/manage/s/article/K000159076
- https://my.f5.com/manage/s/article/K000159824
- https://my.f5.com/manage/s/article/K10812540
- https://my.f5.com/manage/s/article/K16729408
- https://my.f5.com/manage/s/article/K19559038
- https://my.f5.com/manage/s/article/K21054458
- https://my.f5.com/manage/s/article/K48073202
- https://my.f5.com/manage/s/article/K49419538
- https://my.f5.com/manage/s/article/K50310001
- https://my.f5.com/manage/s/article/K52379673
- https://my.f5.com/manage/s/article/K53225395
- https://my.f5.com/manage/s/article/K54724312
- https://my.f5.com/manage/s/article/K57542514
- https://my.f5.com/manage/s/article/K61186963
- https://my.f5.com/manage/s/article/K64119434
- https://my.f5.com/manage/s/article/K67090077
- https://my.f5.com/manage/s/article/K68652018
- https://my.f5.com/manage/s/article/K77326807
- https://my.f5.com/manage/s/article/K78284681
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5155
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7656
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18551
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9636
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10160
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0492
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22720
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34851
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1642