ID

VAR-202208-0207


CVE

CVE-2022-35236


TITLE

BIG-IP  Resource exhaustion vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-016720

DESCRIPTION

In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. BIG-IP Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-35236 // JVNDB: JVNDB-2022-016720 // VULHUB: VHN-431567 // VULMON: CVE-2022-35236

AFFECTED PRODUCTS

vendor:f5model:big-ip fraud protection servicescope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:15.1.6.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:ltversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:ltversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-016720 // NVD: CVE-2022-35236

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-35236
value: HIGH

Trust: 1.0

f5sirt@f5.com: CVE-2022-35236
value: HIGH

Trust: 1.0

OTHER: JVNDB-2022-016720
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202208-2064
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-35236
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

OTHER: JVNDB-2022-016720
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-016720 // CNNVD: CNNVD-202208-2064 // NVD: CVE-2022-35236 // NVD: CVE-2022-35236

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.1

problemtype:Resource exhaustion (CWE-400) [ others ]

Trust: 0.8

sources: VULHUB: VHN-431567 // JVNDB: JVNDB-2022-016720 // NVD: CVE-2022-35236

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-2064

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202208-2064

PATCH

title:K79933541url:https://my.f5.com/manage/s/article/K79933541

Trust: 0.8

sources: JVNDB: JVNDB-2022-016720

EXTERNAL IDS

db:NVDid:CVE-2022-35236

Trust: 3.4

db:JVNDBid:JVNDB-2022-016720

Trust: 0.8

db:CNNVDid:CNNVD-202208-2064

Trust: 0.6

db:VULHUBid:VHN-431567

Trust: 0.1

db:VULMONid:CVE-2022-35236

Trust: 0.1

sources: VULHUB: VHN-431567 // VULMON: CVE-2022-35236 // JVNDB: JVNDB-2022-016720 // CNNVD: CNNVD-202208-2064 // NVD: CVE-2022-35236

REFERENCES

url:https://support.f5.com/csp/article/k79933541

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-35236

Trust: 0.8

url:https://vigilance.fr/vulnerability/f5-big-ip-multiple-vulnerabilities-38983

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-35236/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/400.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-431567 // VULMON: CVE-2022-35236 // JVNDB: JVNDB-2022-016720 // CNNVD: CNNVD-202208-2064 // NVD: CVE-2022-35236

SOURCES

db:VULHUBid:VHN-431567
db:VULMONid:CVE-2022-35236
db:JVNDBid:JVNDB-2022-016720
db:CNNVDid:CNNVD-202208-2064
db:NVDid:CVE-2022-35236

LAST UPDATE DATE

2024-08-14T14:31:02.688000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-431567date:2022-08-10T00:00:00
db:VULMONid:CVE-2022-35236date:2022-08-04T00:00:00
db:JVNDBid:JVNDB-2022-016720date:2023-10-06T02:58:00
db:CNNVDid:CNNVD-202208-2064date:2022-08-11T00:00:00
db:NVDid:CVE-2022-35236date:2022-08-10T18:37:59.443

SOURCES RELEASE DATE

db:VULHUBid:VHN-431567date:2022-08-04T00:00:00
db:VULMONid:CVE-2022-35236date:2022-08-04T00:00:00
db:JVNDBid:JVNDB-2022-016720date:2023-10-06T00:00:00
db:CNNVDid:CNNVD-202208-2064date:2022-08-03T00:00:00
db:NVDid:CVE-2022-35236date:2022-08-04T18:15:10.447