CVEvulnerability

CVE-2021-22981

4.8 MEDIUM Published 2021-02-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N

Description

On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected configurations

• f5 big-ip access policy manager (>= 11.6.1 <= 11.6.5) • f5 big-ip access policy manager (>= 12.1.0 <= 12.1.5) • f5 big-ip advanced firewall manager (>= 11.6.1 <= 11.6.5) • f5 big-ip advanced firewall manager (>= 12.1.0 <= 12.1.5) • f5 big-ip advanced web application firewall (>= 11.6.1 <= 11.6.5) • f5 big-ip advanced web application firewall (>= 12.1.0 <= 12.1.5) • f5 big-ip analytics (>= 11.6.1 <= 11.6.5) • f5 big-ip analytics (>= 12.1.0 <= 12.1.5) • f5 big-ip application acceleration manager (>= 11.6.1 <= 11.6.5) • f5 big-ip application acceleration manager (>= 12.1.0 <= 12.1.5) • f5 big-ip application security manager (>= 11.6.1 <= 11.6.5) • f5 big-ip application security manager (>= 12.1.0 <= 12.1.5) • f5 big-ip ddos hybrid defender (>= 11.6.1 <= 11.6.5) • f5 big-ip ddos hybrid defender (>= 12.1.0 <= 12.1.5) • f5 big-ip domain name system (>= 11.6.1 <= 11.6.5) • f5 big-ip domain name system (>= 12.1.0 <= 12.1.5) • f5 big-ip fraud protection service (>= 11.6.1 <= 11.6.5) • f5 big-ip fraud protection service (>= 12.1.0 <= 12.1.5) • f5 big-ip global traffic manager (>= 11.6.1 <= 11.6.5) • f5 big-ip global traffic manager (>= 12.1.0 <= 12.1.5) • f5 big-ip link controller (>= 11.6.1 <= 11.6.5) • f5 big-ip link controller (>= 12.1.0 <= 12.1.5) • f5 big-ip local traffic manager (>= 11.6.1 <= 11.6.5) • f5 big-ip local traffic manager (>= 12.1.0 <= 12.1.5) • f5 big-ip policy enforcement manager (>= 11.6.1 <= 11.6.5) • f5 big-ip policy enforcement manager (>= 12.1.0 <= 12.1.5) • f5 big-ip ssl orchestrator (>= 11.6.1 <= 11.6.5) • f5 big-ip ssl orchestrator (>= 12.1.0 <= 12.1.5)

References