개요
F5(https://www.f5.com/)에서는 공급한 제품의 취약점을 해결하는 보안 업데이트를 발표하였습니다. 해당하는 제품 사용자는 최신 버전으로 업데이트 하시기 바랍니다.
대상 제품
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 15.1.0 – 15.1.9
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 16.1.0 – 16.1.3
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 17.1.0
BIG-IP (AFM + IPS) 15.1.0 – 15.1.8
BIG-IP (AFM + IPS) 16.1.0 – 16.1.3
BIG-IP (AFM + IPS) 17.1.0
BIG-IP (AFM) 15.1.0 – 15.1.9
BIG-IP (AFM) 16.1.0 – 16.1.3
BIG-IP (AFM) 17.1.0
BIG-IP (Advanced WAF/ASM) 16.1.0 – 16.1.3
BIG-IP (Advanced WAF/ASM) 17.1.0
BIG-IP (PEM) 15.1.0 – 15.1.103
BIG-IP (PEM) 16.1.0 – 16.1.43
BIG-IP (PEM) 17.1.0 – 17.1.13
BIG-IP 15.1.0 – 15.1.8
BIG-IP 15.1.0 – 15.1.9
BIG-IP 16.1.0 – 16.1.3
BIG-IP 17.1.0
BIG-IP Next SPK 1.5.0 – 1.8.0
NGINX Open Source 1.25.0 – 1.25.3
NGINX Open Source 1.25.3
NGINX Plus R31
NGINX Plus R31 및 R30
해결된 취약점
BIG-IP (PEM)에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23982, CVSS 7.5) [1]
BIG-IP (Advanced WAF/ASM)에서 메모리 리소스 증가로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-21789, CVSS 7.5) [2]
BIG-IP (AFM)에서 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-21763, CVSS 7.5) [3]
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM)에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23805, CVSS 7.5) [4]
BIG-IP에서 조작된 트래픽으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-24775, CVSS 7.5) [5]
BIG-IP Next SPK에서 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23314, CVSS 7.5) [6]
BIG-IP에서 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23314, CVSS 7.5) [6]
NGINX Open Source에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-24990, CVSS 7.5) [7]
NGINX Plus에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-24990, CVSS 7.5) [7]
NGINX Open Source에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-24989, CVSS 7.5) [8]
NGINX Plus에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-24989, CVSS 7.5) [8]
BIG-IP에서 조작된 iControl REST로 발생하는 임의 코드 실행 취약점 (CVE-2024-22093, CVSS 8.7) [9]
BIG-IP (Advanced WAF/ASM)에서 조작된 요청으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23308, CVSS 7.5) [10]
BIG-IP에서 CPU 사용률 증가로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-23979, CVSS 7.5) [11]
BIG-IP (Advanced WAF/ASM)에서 조작된 트래픽으로 발생하는 서비스 거부(DoS) 취약점 (CVE-2024-21849, CVSS 7.5) [12]
BIG-IP (AFM + IPS)에서 발생하는 취약점 (CVE-2024-21771, CVSS 7.5) [13]
BIG-IP에서 발생하는 취약점 (CVE-2024-22389, CVSS 7.2) [14]
취약점 패치
02월 14일 게시된 보안 권고에 따라 해당 버전 및 최신 버전으로 업데이트 하시기 바랍니다.
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 15.1.10
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 16.1.4
Application Visibility and Reporting module and BIG-IP (Advanced WAF/ASM) 17.1.1
BIG-IP (AFM + IPS) 15.1.9
BIG-IP (AFM + IPS) 16.1.4
BIG-IP (AFM + IPS) 17.1.1
BIG-IP (AFM) 15.1.10
BIG-IP (AFM) 16.1.4
BIG-IP (AFM) 17.1.1
BIG-IP (Advanced WAF/ASM) 16.1.4
BIG-IP (Advanced WAF/ASM) 17.1.0
BIG-IP (Advanced WAF/ASM) 17.1.1
BIG-IP 15.1.10
BIG-IP 15.1.9
BIG-IP 16.1.4
BIG-IP 17.1.1
BIG-IP Next SPK 1.8.1
NGINX Open Source 1.25.4
NGINX Plus R31 P1
NGINX Plus R31 P1 및 R30 P2
참고 사이트
[1] K000135946: BIG-IP PEM vulnerability CVE-2024-23982
https://my.f5.com/manage/s/article/K000135946
[2] K000137270: BIG-IP Advanced WAF and BIG-IP ASM and vulnerability CVE-2024-21789
https://my.f5.com/manage/s/article/K000137270
[3] K000137521: BIG-IP AFM vulnerability CVE-2024-21763
https://my.f5.com/manage/s/article/K000137521
[4] K000137334: F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability CVE-2024-23805
https://my.f5.com/manage/s/article/K000137334
[5] K000137333: BIG-IP TMM vulnerability CVE-2024-24775
https://my.f5.com/manage/s/article/K000137333
[6] K000137675: BIG-IP HTTP/2 vulnerability CVE-2024-23314
https://my.f5.com/manage/s/article/K000137675
[7] K000138445: NGINX HTTP/3 QUIC vulnerability CVE-2024-24990
https://my.f5.com/manage/s/article/K000138445
[8] K000138444: NGINX HTTP/3 QUIC vulnerability CVE-2024-24989
https://my.f5.com/manage/s/article/K000138444
[9] K000137522: BIG-IP iControl REST vulnerability CVE-2024-22093
https://my.f5.com/manage/s/article/K000137522
[10] K000137416: BIG-IP Advanced WAF and BIG-IP ASM vulnerability CVE-2024-23308
https://my.f5.com/manage/s/article/K000137416
[11] K000134516: BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability CVE-2024-23979
https://my.f5.com/manage/s/article/K000134516
[12] K000135873: BIG-IP Websockets vulnerability CVE-2024-21849
https://my.f5.com/manage/s/article/K000135873
[13] K000137595: BIG-IP AFM signature matching vulnerability CVE-2024-21771
https://my.f5.com/manage/s/article/K000137595
[14] K32544615: BIG-IP iControl REST API vulnerability CVE-2024-22389