The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K57542514 advisory.

  - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate     cookies or authentication data and send that information to a different host than when parsed correctly.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8,     v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1;
    v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9636)

  - A security regression of CVE-2019-9636 was discovered in python since commit     d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through     v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts     of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or     other kind of information, it is possible for an attacker to provide specially crafted URLs to make the     application locate host-related information (e.g. cookies, authentication data) and send them to a     different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack     may vary based on the application. (CVE-2019-10160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

F5 Networks BIG-IP : Python vulnerabilities (K57542514)

critical Nessus Plugin ID 151496

Version 1.7

Version 1.6

Version 1.6

Version 1.5

Version 1.7 Jan 5, 2024, 11:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401051133
Version 1.6 Jan 5, 2024, 9:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401050943
Version 1.6 Nov 2, 2023, 8:18 PM CVSSv2 score source (set to "CVE-2019-9636") Detection (updated detection logic) Plugin metadata Plugin Feed: 202311022018
Version 1.5 Nov 2, 2023, 6:19 PM CVSSv2 score source (set to "CVE-2019-9636") Detection (updated detection logic) Plugin metadata Plugin Feed: 202311021819