CVE-2017-0303
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 1…
Published 9 y ago · modified 4 mo ago · JSON
Summary
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections.
Exploit prediction (EPSS)
2.66% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- F5 Networks, Inc. BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe
Classification
- Weakness
- CWE-459 Incomplete Cleanup
References
- support.f5.com /csp/article/K30201296 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/101612 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1039674 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2017-0303
- NVD: CVE-2017-0303
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.