CVE-2022-41836

Summary

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate.

Affected Software

VendorProductVersion RangeStatus
F5BIG-IP Advanced WAF & ASM17.0.x < 17.0.0.1affected
F5BIG-IP Advanced WAF & ASM16.1.x < 16.1.3.1affected
F5BIG-IP Advanced WAF & ASM15.1.x < 15.1.7affected
F5BIG-IP Advanced WAF & ASM14.1.0 < 14.1.x*unaffected
F5BIG-IP Advanced WAF & ASM13.1.0 < 13.1.x*unaffected

Weaknesses

  • CWE-20: CWE-20 Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References