Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-41983
CVE-2022-41983:
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation
Overview
On specific hardware platforms, BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x are affected by a vulnerability where undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use (CVE Mitre).
Technical details
The vulnerability affects BIG-IP systems using Intel QAT (QuickAssist Technology) in conjunction with AES-GCM/CCM cipher. Under certain undisclosed conditions, the system may transmit data without encryption despite having an SSL Profile configured (CVE Mitre).
Impact
The vulnerability could result in sensitive data being transmitted in cleartext even when encryption is configured, potentially exposing confidential information to unauthorized parties (CVE Mitre).
Mitigation and workarounds
F5 has released patched versions to address this vulnerability. Users should upgrade to BIG-IP version 16.1.3.1, 15.1.7, or 14.1.5.1 depending on their current version track. Systems running version 13.1.x should be upgraded to a supported version (CVE Mitre).
Additional resources
Source: This report was generated using AI
Related F5 BIG-IP Advanced Firewall Manager vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management