CVE-2020-5883: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST request...

Summary

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
f5	big-ip_access_policy_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_access_policy_manager::::::::`
f5	big-ip_advanced_firewall_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_advanced_firewall_manager::::::::`
f5	big-ip_webaccelerator	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_webaccelerator::::::::`
f5	big-ip_application_acceleration_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_application_acceleration_manager::::::::`
f5	big-ip_application_security_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_application_security_manager::::::::`
f5	big-ip_fraud_protection_service	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_fraud_protection_service::::::::`
f5	big-ip_edge_gateway	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_edge_gateway::::::::`
f5	big-ip_link_controller	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_link_controller::::::::`
f5	big-ip_local_traffic_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_local_traffic_manager::::::::`
f5	big-ip_policy_enforcement_manager	>= 13.1.0, <= 13.1.3.1 >= 14.0.0, <= 14.0.1 >= 14.1.0, <= 14.1.2.3 >= 15.0.0, <= 15.0.1.3 `cpe:2.3:a:f5:big-ip_policy_enforcement_manager::::::::`

Original advisory text

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST request...

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.

References

https://support.f5.com/csp/article/K12234501 Vendor Advisory