Detections
Analytics

F5 Networks BIG-IP : Python vulnerabilities (K000139691)

critical Nessus Plugin ID 197530

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K000139691 advisory.

 - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

 - Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. (CVE-2018-1000802)

 - An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. (CVE-2016-9063)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

The vendor has acknowledged the vulnerability, but no solution has been provided.
Refer to the vendor for remediation guidance.

See Also

https://my.f5.com/manage/s/article/K000139691

Plugin Details

Severity: Critical

ID: 197530

File Name: f5_bigip_SOL000139691.nasl

Version: 1.0

Type: local

Published: 5/20/2024

Updated: 5/20/2024

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-1000802

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-48565

Vulnerability Information

CPE: cpe:/a:f5:big-ip_domain_name_system, cpe:/h:f5:big-ip, cpe:/a:f5:big-ip_global_traffic_manager

Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 11/15/2016

Reference Information

CVE: CVE-2016-9063, CVE-2018-1000802, CVE-2022-48565