Applies To:
Show Versions
BIG-IP AAM
- 13.1.5
BIG-IP APM
- 13.1.5
BIG-IP Link Controller
- 13.1.5
BIG-IP Analytics
- 13.1.5
BIG-IP LTM
- 13.1.5
BIG-IP AFM
- 13.1.5
BIG-IP PEM
- 13.1.5
BIG-IP FPS
- 13.1.5
BIG-IP DNS
- 13.1.5
BIG-IP ASM
- 13.1.5
BIG-IP Release Information
Version: 13.1.5.1
Build: 2.0
Note: This content is current as of the software release date
Updates to bug information occur periodically. For the most up-to-date bug data, see Bug Tracker.
The blue background highlights fixes |
Cumulative fixes from BIG-IP v13.1.5 that are included in this release
Cumulative fixes from BIG-IP v13.1.4.1 that are included in this release
Cumulative fixes from BIG-IP v13.1.4 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.6 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.5 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.4 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.3 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.2 that are included in this release
Cumulative fixes from BIG-IP v13.1.3.1 that are included in this release
Cumulative fixes from BIG-IP v13.1.3 that are included in this release
Cumulative fixes from BIG-IP v13.1.2 that are included in this release
Cumulative fixes from BIG-IP v13.1.1.5 that are included in this release
Cumulative fixes from BIG-IP v13.1.1.4 that are included in this release
Cumulative fixes from BIG-IP v13.1.1.3 that are included in this release
Cumulative fixes from BIG-IP v13.1.1.2 that are included in this release
Cumulative fixes from BIG-IP v13.1.1.1 that are included in this release
Cumulative fixes from BIG-IP v13.1.1 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.8 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.7 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.6 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.5 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.4 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.3 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.2 that are included in this release
Cumulative fixes from BIG-IP v13.1.0.1 that are included in this release
Known Issues in BIG-IP v13.1.x
Functional Change Fixes
None
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1106289-5 | 3-Major | TMM may leak memory when processing sideband connections. | 17.0.0.1, 13.1.5.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1093621-4 | 2-Critical | Some SIP traffic patterns over TCP may cause resource exhaustion on BIG-IP | 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1, 13.1.5.1 |
Cumulative fixes from BIG-IP v13.1.5 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
965853-5 | CVE-2022-28695 | K08510472, BT965853 | IM package file hardening★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1051561-4 | CVE-2022-1388 | K23605346, BT1051561 | BIG-IP iControl REST vulnerability CVE-2022-1388 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
999933-5 | CVE-2022-23017 | K28042514, BT999933 | TMM may crash while processing DNS traffic on certain platforms | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
993981-5 | CVE-2022-28705 | K52340447, BT993981 | TMM may crash when ePVA is enabled | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
989701-3 | CVE-2020-25212 | K42355373, BT989701 | CVE-2020-25212 Kernel: A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
982697-3 | CVE-2022-26071 | K41440465, BT982697 | ICMP hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
981461-2 | CVE-2021-23032 | K45407662, BT981461 | Unspecified DNS responses cause TMM crash | 16.1.0, 15.1.3.1, 14.1.4.4, 13.1.5 |
966901-4 | CVE-2020-14364 | K09081535, BT966901 | CVE-2020-14364: Qemu Vulnerability | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
951257-2 | CVE-2022-26130 | K82034427, BT951257 | FTP active data channels are not established | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
946325-4 | CVE-2022-28716 | K25451853, BT946325 | PEM subscriber GUI hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
940317-2 | CVE-2020-13692 | K23157312, BT940317 | CVE-2020-13692: PostgreSQL JDBC Driver vulnerability | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
937333-5 | CVE-2022-23013 | K29500533, BT937333 | Incomplete validation of input in unspecified forms | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
904165-4 | CVE-2020-27716 | K51574311, BT904165 | BIG-IP APM vulnerability CVE-2020-27716 | 16.0.0, 15.1.1, 14.1.3.1, 13.1.5 |
818169-4 | CVE-2022-26372 | K23454411, BT818169 | TMM may consume excessive resources when processing DNS profiles with DNS queing enabled | 16.0.0, 15.1.0.2, 14.1.4.6, 13.1.5 |
550928-3 | CVE-2022-23010 | K34360320, BT550928 | TMM may crash when processing HTTP traffic with a FastL4 virtual server | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
1089373-3 | CVE-2022-0778 | K31323265 | OpenSSL Vulnerability: CVE-2022-0778 | 13.1.5 |
1089237-2 | CVE-2022-0778 | K31323265 | OpenSSL Vulnerability: CVE-2022-0778 | 13.1.5 |
1087201-3 | CVE-2022-0778 | K31323265, BT1087201 | OpenSSL Vulnerability: CVE-2022-0778 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1078721-3 | CVE-2022-27189 | K16187341, BT1078721 | TMM may consume excessive resources while processing ICAP traffic | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1067993-7 | CVE-2022-28714 | K54460845, BT1067993 | APM Windows Client installer hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1059185-4 | CVE-2022-26415 | K81952114, BT1059185 | iControl REST Hardening | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1051797-4 | CVE-2018-18281 | K36462841, BT1051797 | Linux kernel vulnerability: CVE-2018-18281 | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1047053-4 | CVE-2022-28691 | K37155600, BT1047053 | TMM may consume excessive resources while processing RTSP traffic | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1045101-1 | CVE-2022-26890 | K03442392, BT1045101 | Bd may crash while processing ASM traffic | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.6, 13.1.5 |
1032405-5 | CVE-2021-23037 | K21435974, BT1032405 | TMUI XSS vulnerability CVE-2021-23037 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1030689-4 | CVE-2022-23019 | K82793463, BT1030689 | TMM may consume excessive resources while processing Diameter traffic | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
1028669-3 | CVE-2019-9948 | K28622040, BT1028669 | Python vulnerability: CVE-2019-9948 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1028497-3 | CVE-2019-15903 | K05295469, BT1028497 | libexpat vulnerability: CVE-2019-15903 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1019161-6 | CVE-2022-29263 | K33552735, BT1019161 | Windows installer(VPN through browser components installer) as administrator user uses temporary folder to create files★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1017973-4 | CVE-2021-25215 | K96223611, BT1017973 | BIND Vulnerability CVE-2021-25215 | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
1007489-3 | CVE-2022-23018 | K24358905, BT1007489 | TMM may crash while handling specific HTTP requests★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
997193-3 | CVE-2022-23028 | K16101409, BT997193 | TCP connections may fail when AFM global syncookies are in operation. | 16.1.0, 15.1.5, 14.1.4.5, 13.1.5 |
992073-5 | CVE-2022-27181 | K93543114, BT992073 | APM NTLM Front End Authentication errors ECA_ERR_INPROGRESS | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
982757-7 | CVE-2022-26835 | K53197140 | APM Access Guided Configuration hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
982341-3 | CVE-2022-26835 | K53197140, BT982341 | iControl REST endpoint hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
981693-5 | CVE-2022-23024 | K54892865, BT981693 | TMM may consume excessive resources while processing IPSec ALG traffic | 16.1.0, 15.1.4.1, 14.1.4.2, 13.1.5 |
981273-4 | CVE-2021-23054 | K41997459, BT981273 | APM webtop hardening | 17.0.0, 15.1.4, 14.1.5, 13.1.5 |
975593-1 | CVE-2022-29473 | K06323049, BT975593 | TMM may crash while processing IPSec traffic | 16.1.0, 15.1.5.1, 14.1.4.5, 13.1.5 |
974341-4 | CVE-2022-23026 | K08402414, BT974341 | REST API: File upload | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
974093-2 | CVE-2020-25705 | K09604370 | Linux kernel vulnerability CVE-2020-25705 | 13.1.5 |
962069-6 | CVE-2021-23047 | K79428827, BT962069 | Excessive resource consumption while processing OSCP requests via APM | 16.1.0, 15.1.3.1, 14.1.4.4, 13.1.5 |
941649-5 | CVE-2021-23043 | K63163637, BT941649 | Local File Inclusion Vulnerability | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
940185-4 | CVE-2022-23023 | K11742742, BT940185 | icrd_child may consume excessive resources while processing REST requests | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
931677-3 | CVE-2022-29479 | K64124988, BT931677 | IPv6 hardening | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
915981-1 | CVE-2022-26340 | K38271531, BT915981 | BIG-IP SCP hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
907201-5 | CVE-2021-23039 | K66782293, BT907201 | TMM may crash when processing IPSec traffic | 16.1.0, 16.0.1.2, 15.1.3, 14.1.2.8, 13.1.5 |
887965-4 | CVE-2022-23027 | K30573026, BT887965 | Virtual server may stop responding while processing TCP traffic | 16.0.0, 15.1.4, 14.1.4.4, 13.1.5 |
870273-2 | CVE-2020-5936 | K44020030, BT870273 | TMM may consume excessive resources when processing SSL traffic | 16.0.0, 15.1.1, 14.1.2.8, 13.1.5, 12.1.5.2 |
803965-4 | CVE-2018-20843 | K51011533, BT803965 | Expat Vulnerability: CVE-2018-20843 | 17.0.0, 16.1.2, 15.1.4, 14.1.4.5, 13.1.5 |
1071365-2 | CVE-2022-29474 | K59904248, BT1071365 | iControl SOAP WSDL hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1064961-5 | CVE-2022-29480 | K71103363 | big3d may consume excessive resources when processing route domains | 13.1.5 |
1017965-4 | CVE-2021-25214 | K11426315, BT1017965 | BIND Vulnerability CVE-2021-25214 | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
1016657-5 | CVE-2022-26517 | K54082580, BT1016657 | TMM may crash while processing LSN traffic | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
1013145-4 | CVE-2021-23052 | K32734107 | APM Hardening | 14.1.4.4, 13.1.5 |
1009725-5 | CVE-2022-23030 | K53442005, BT1009725 | Excessive resource usage when ixlv drivers are enabled | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1009049-7 | CVE-2022-27636 | K57110035, BT1009049 | browser based vpn did not follow best practices while logging.★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1008561-2 | CVE-2022-23025 | K44110411, BT1008561 | In very rare condition, BIG-IP may crash when SIP ALG is deployed | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
1008077-3 | CVE-2022-23029 | K50343028, BT1008077 | TMM may crash while processing TCP traffic with a FastL4 VS | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1050537-4 | 2-Critical | BT1050537 | GTM pool member with none monitor will be part of load balancing decisions. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
911141-5 | 3-Major | BT911141 | GTP v1 APN is not decoded/encoded properly | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
1046669-4 | 3-Major | BT1046669 | The audit forwarders may prematurely time out waiting for TACACS responses | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1015133-1 | 3-Major | BT1015133 | Tail loss can cause TCP TLP to retransmit slowly. | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
985953-1 | 4-Minor | BT985953 | GRE Transparent Ethernet Bridging inner MAC overwrite | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1033837-4 | 4-Minor | K23605346, BT1033837 | REST authentication tokens persist on reboot★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1042993-4 | 1-Blocking | K19272127, BT1042993 | Provisioning high availability (HA) setup wizard fails to load, reports 'No Access' | 17.0.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
1002109-5 | 1-Blocking | BT1002109 | Xen binaries do not follow security best practices | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
980325-3 | 2-Critical | BT980325 | Chmand core due to memory leak from dossier requests. | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
957897-3 | 2-Critical | BT957897 | Unable to modify gateway-ICMP monitor fields in the GUI | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
817709-4 | 2-Critical | BT817709 | IPsec: TMM cored with SIGFPE in racoon2 | 16.1.0, 15.1.0.2, 14.1.2.8, 13.1.5 |
775897-3 | 2-Critical | BT775897 | High Availability failover restarts tmipsecd when tmm connections are closed | 15.1.0, 14.1.2.5, 13.1.5 |
741676-1 | 2-Critical | BT741676 | Intermittent crash switching between tunnel mode and interface mode | 15.1.0, 14.1.2.8, 13.1.5 |
1043277-1 | 2-Critical | BT1043277 | 'No access' error page displays for APM policy export and apply options. | 17.0.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
1024325-1 | 2-Critical | BT1024325 | EHF installation is not updating the Linux Kernel | 13.1.5 |
1004929-3 | 2-Critical | BT1004929 | During config sync operation, MCPD restarts on secondary blade logging 01020012:3: A unsigned four-byte integer message item is invalid. | 17.0.0, 15.1.5, 14.1.4.5, 13.1.5 |
999125-4 | 3-Major | BT999125 | After changing management IP addresses, devices can be stuck indefinitely in improper Active/Active or Standby/Standby states. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
969105-5 | 3-Major | BT969105 | HA failover connections via the management address do not work on vCMP guests running on VIPRION | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
958093-1 | 3-Major | BT958093 | IPv6 routes missing after BGP graceful restart | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
956589-4 | 3-Major | BT956589 | The tmrouted daemon restarts and produces a core file | 16.1.0, 15.1.2.1, 14.1.4.6, 13.1.5 |
947529-3 | 3-Major | BT947529 | Security tab in virtual server menu renders slowly | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
919317-2 | 3-Major | BT919317 | NSM consumes 100% CPU processing nexthops for recursive ECMP routes | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
918409-5 | 3-Major | BT918409 | BIG-IP i15600 / i15800 does not monitor all tmm processes for heartbeat failures | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
856953-6 | 3-Major | BT856953 | IPsec: TMM cores after ike-peer switched version from IKEv2 to IKEv1 | 16.0.0, 15.1.4.1, 14.1.2.8, 13.1.5 |
809657-4 | 3-Major | BT809657 | HA Group score not computed correctly for an unmonitored pool when mcpd starts | 16.0.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
760950-2 | 3-Major | BT760950 | Incorrect advertised next-hop in BGP for a traffic group in Active-Active deployment | 15.0.0, 14.1.2.7, 13.1.5, 12.1.5.3 |
755976-1 | 3-Major | BT755976 | ZebOS might miss kernel routes after mcpd deamon restart | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
719555 | 3-Major | BT719555 | Interface listed as 'disable' after SFP insertion and enable | 16.0.0, 15.1.1, 14.1.4, 13.1.5 |
1066285-2 | 3-Major | BT1066285 | Master Key decrypt failure - decrypt failure. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1047169-4 | 3-Major | BT1047169 | GTM AAAA pool can be deleted from the configuration despite being in use by an iRule. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1045421-4 | 3-Major | K16107301, BT1045421 | No Access error when performing various actions in the TMOS GUI | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1042009-4 | 3-Major | BT1042009 | Mcpd fails to reply if a request is proxied to another daemon and the connection to that daemon closes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1032077 | 3-Major | BT1032077 | TACACS authentication fails with tac_author_read: short author body | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1022637-4 | 3-Major | BT1022637 | A partition other than /Common may fail to save the configuration to disk | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1020789-1 | 3-Major | BT1020789 | Cannot deploy a four-core vCMP guest if the remaining cores are in use. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5 |
1019085-3 | 3-Major | BT1019085 | Network virtual-addresses fail to retain the "icmp-echo enabled" property following an upgrade or reload of the configuration from file.★ | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
1010393-2 | 3-Major | BT1010393 | Unable to relax AS-path attribute in multi-path selection | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
1008269-5 | 3-Major | BT1008269 | Error: out of stack space | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1003257-2 | 3-Major | BT1003257 | ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' do not work as expected | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
884165-1 | 4-Minor | BT884165 | Datasync regenerating CAPTCHA table causing frequent syncs of datasync-device DG | 16.0.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
713614-6 | 4-Minor | BT713614 | Virtual address (/Common/10.10.10.10) shares address with floating self IP (/Common/10.10.10.10), so traffic-group is being kept at (/Common/traffic-group-local-only) | 16.0.0, 15.1.0.5, 14.1.4.6, 13.1.5 |
528894-8 | 4-Minor | BT528894 | Config-Sync after non-Common partition config changes results in extraneous config stanzas in the config files of the non-Common partition | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1046693-1 | 4-Minor | BT1046693 | TMM with BFD confgured might crash under significant memory pressure | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1045549-1 | 4-Minor | BT1045549 | BFD sessions remain DOWN after graceful TMM restart | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1040821-1 | 4-Minor | BT1040821 | Enabling an iRule or selecting a pool re-checks the "Address Translation" and "Port Translation" checkboxes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1034589-4 | 4-Minor | BT1034589 | No warning is given when a pool or trunk that was in use by an high availability (HA) Group is deleted from the configuration. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1024621-1 | 4-Minor | BT1024621 | Re-establishing BFD session might take longer than expected. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1002809-5 | 4-Minor | BT1002809 | OSPF vertex-threshold should be at least 100 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1005433-1 | 1-Blocking | BT1005433 | LTM Pool Members may not be updated accurately when multiple identical database monitors are configured | 14.1.4.5, 13.1.5 |
910213-5 | 2-Critical | BT910213 | LB::down iRule command is ineffective, and can lead to inconsistent pool member status | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
757407-2 | 2-Critical | BT757407 | Error reading RRD file may induce processes to mutually wait for each other forever | 15.0.0, 14.1.4.6, 13.1.5 |
1064617-4 | 2-Critical | BT1064617 | DBDaemon process may write to monitor log file indefinitely | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1019081-1 | 2-Critical | K97045220, BT1019081 | HTTP/2 hardening | 16.1.0, 15.1.3.1, 14.1.4.5, 13.1.5 |
963705-1 | 3-Major | BT963705 | Proxy ssl server response not forwarded | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
955617-5 | 3-Major | BT955617 | Cannot modify properties of a monitor that is already in use by a pool | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
941257-3 | 3-Major | BT941257 | Occasional Nitrox3 ZIP engine hang | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
912517-5 | 3-Major | BT912517 | Database monitor marks pool member down if 'send' is configured but no 'receive' strings are configured | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
904041-5 | 3-Major | BT904041 | Ephemeral pool members may be incorrect when modified via various actions | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
819329-3 | 3-Major | BT819329 | Specific FIPS device errors will not trigger failover | 16.1.0, 16.0.1.2, 15.1.4, 14.1.3.1, 13.1.5 |
803629-4 | 3-Major | BT803629 | SQL monitor fails with 'Analyze Response failure' message even if recv string is correct | 16.1.0, 16.0.1.1, 15.1.4.1, 14.1.4.5, 13.1.5 |
793669-4 | 3-Major | BT793669 | FQDN ephemeral pool members on high availability (HA) pair does not get properly synced of the new session value. | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
757446-1 | 3-Major | BT757446 | Invoking the HTTP::respond iRule command when the HTTP2 profile is present can cause stalled or malformed responses. | 15.0.0, 14.1.2.7, 13.1.5 |
672963-4 | 3-Major | BT672963 | MSSQL monitor fails against databases using non-native charset | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1052929-1 | 3-Major | BT1052929 | MCPD logs "An internal login failure is being experienced on the FIPS card" when FIPS HSM is uninitialized. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1038629-2 | 3-Major | BT1038629 | DTLS virtual server not performing clean shutdown upon reception of CLOSE_NOTIFY from client | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
1034365 | 3-Major | BT1034365 | DTLS handshake fails with DTLS1.2 client version | 15.1.5, 14.1.4.5, 13.1.5 |
1029897-4 | 3-Major | K63312282, BT1029897 | Malformed HTTP2 requests can be passed to HTTP/1.1 server-side pool members. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1023341-4 | 3-Major | HSM hardening | 17.0.0, 16.1.1, 15.1.5.1, 14.1.4.6, 13.1.5 | |
1018577-1 | 3-Major | BT1018577 | SASP monitor does not mark pool member with same IP Address but different Port from another pool member | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1017513-1 | 3-Major | BT1017513 | Config sync fails with error Invalid monitor rule instance identifier or monitors are in a bad state such as checking | 17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5 |
1015161-4 | 3-Major | BT1015161 | Ephemeral pool member may not be created when FQDN resolves to address that matches static node | 16.1.0, 15.1.5.1, 14.1.4.5, 13.1.5 |
1008017-3 | 3-Major | BT1008017 | Validation failure on Enforce TLS Requirements and TLS Renegotiation | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
936557-4 | 4-Minor | BT936557 | Retransmissions of the initial SYN segment on the BIG-IP system's server-side incorrectly use a non-zero acknowledgement number when Verified Accept is enabled. | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
935593-2 | 4-Minor | BT935593 | Incorrect SYN re-transmission handling with FastL4 timestamp rewrite | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.5 |
757777-2 | 4-Minor | BT757777 | bigtcp does not issue a RST in all circumstances | 15.1.0, 14.1.2.5, 13.1.5 |
717806-4 | 4-Minor | BT717806 | In the case of 'n' bigd instances, uneven CPU load distribution is seen when a high number of monitors are configured | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1026605-1 | 4-Minor | BT1026605 | When bigd.mgmtroutecheck is enabled monitor probes may be denied for non-mgmt routes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1018493-4 | 4-Minor | BT1018493 | Response code 304 from TMM Cache always closes TCP connection. | 17.0.0, 16.1.2, 15.1.4, 14.1.4.5, 13.1.5 |
898929-1 | 5-Cosmetic | BT898929 | Tmm might crash when ASM, AVR, and pool connection queuing are in use | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
873249-4 | 5-Cosmetic | BT873249 | Switching from fast_merge to slow_merge can result in incorrect tmm stats | 16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
995853-4 | 2-Critical | BT995853 | Mixing IPv4 and IPv6 device IPs on GSLB server object results in nullGeneral database error. | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
905557-5 | 2-Critical | BT905557 | Logging up/down transition of DNS/GTM pool resource via HSL can trigger TMM failure | 16.0.0, 15.1.2, 14.1.4, 13.1.5 |
850509-2 | 2-Critical | BT850509 | Zone Trusted Signature inadequately maintained, following change of master key | 16.0.0, 15.1.2, 14.1.4.4, 13.1.5 |
741862-2 | 2-Critical | BT741862 | DNS GUI may generate error or display names with special characters incorrectly. | 15.0.0, 14.1.4.6, 13.1.5 |
1062513-1 | 2-Critical | BT1062513 | GUI returns 'no access' error message when modifying a GTM pool property. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1035853-5 | 2-Critical | K41415626, BT1035853 | Transparent DNS Cache can consume excessive resources. | 17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5 |
993489-6 | 3-Major | BT993489 | GTM daemon leaks memory when reading GTM link objects | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
847105-4 | 3-Major | BT847105 | The bigip_gtm.conf is reverted to default after rebooting with license expired★ | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
644192-6 | 3-Major | K23022557, BT644192 | Query of "MX" "any" RR of CNAME wide IP results in NXDOMAIN | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.5, 11.6.5.3 |
1046785-5 | 3-Major | BT1046785 | Missing GTM probes when max synchronous probes are exceeded. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5, 13.1.5 |
1044425-5 | 3-Major | K85021277, BT1044425 | NSEC3 record improvements for NXDOMAIN | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1024553-4 | 3-Major | BT1024553 | GTM Pool member set to monitor type "none" results in big3d: timed out | 15.1.5, 14.1.4.5, 13.1.5 |
1021417-5 | 3-Major | BT1021417 | Modifying GTM pool members with replace-all-with results in pool members with order 0 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1021061-1 | 3-Major | BT1021061 | Config fails to load for large config on platform with Platform FIPS license enabled | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
1018613-5 | 3-Major | BT1018613 | Modify wideip pools with replace-all-with results pools with same order 0 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1011285-5 | 3-Major | BT1011285 | The iControl REST API no longer accepts an empty 'lastResortPool' property for wide IP objects. | 16.1.0, 15.1.5, 13.1.5 |
816277-3 | 4-Minor | BT816277 | Extremely long nameserver name causes GUI Error | 16.0.0, 14.1.4.4, 13.1.5 |
753821-1 | 4-Minor | BT753821 | Log messages 'TCP RST from remote system' messages logged if GTM/DNS is licensed but not provisioned | 15.0.0, 14.1.4.6, 13.1.5 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
997137-5 | 2-Critical | K80945213, BT997137 | CSRF token modification may allow WAF bypass on GET requests | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
993613-3 | 2-Critical | BT993613 | Device fails to request full sync | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
970329-5 | 2-Critical | K70134152, BT970329 | ASM hardening | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
965229-4 | 2-Critical | BT965229 | ASM Load hangs after upgrade★ | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
912149-3 | 2-Critical | BT912149 | ASM sync failure with Cgc::Channel error 'Failed to send a message, error:15638476' | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
879841-2 | 2-Critical | BT879841 | Domain cookie same-site option is missing the "None" as value in GUI and rest | 16.0.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
723061-1 | 2-Critical | BT723061 | Possible tmm core during high load, or when an ASM policy is enabled by other modules | 14.1.0, 13.1.5 |
1079909-4 | 2-Critical | K82724554, BT1079909 | Bd core | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5 |
1069449-4 | 2-Critical | K39002226, BT1069449 | ASM attack signatures may not match cookies as expected | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1019853-4 | 2-Critical | K30911244, BT1019853 | Some signatures are not matched under specific conditions | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1011061-5 | 2-Critical | K39002226, BT1011061 | Certain attack signatures may not match in multipart content | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
987157 | 3-Major | K05391775, BT987157 | BIG-IP ASM system may not properly perform attack signature checks | 13.1.5 |
984593-4 | 3-Major | BT984593 | BD crash | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
964245-4 | 3-Major | BT964245 | ASM reports and enforces username always | 16.1.0, 15.1.4, 14.1.4.4, 13.1.5 |
962497-5 | 3-Major | BT962497 | BD crash after ICAP response | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
956937 | 3-Major | BT956937 | Duplicate Attack signature sets in policy containing server technologies | 13.1.5 |
946081-4 | 3-Major | BT946081 | Getcrc tool help displays directory structure instead of version | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
932133-4 | 3-Major | BT932133 | Payloads with large number of elements in XML take a lot of time to process | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
926845-3 | 3-Major | BT926845 | Inactive ASM policies are deleted upon upgrade | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
920197-1 | 3-Major | BT920197 | Brute force mitigation can stop mitigating without a notification | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
871905-5 | 3-Major | K02705117, BT871905 | Incorrect masking of parameters in event log | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.5 |
871881-3 | 3-Major | BT871881 | Apply Policy action is not synchronized after making bulk signature changes | 14.1.4.6, 13.1.5 |
867825-1 | 3-Major | BT867825 | Export/Import on a parent policy leaves children in an inconsistent state | 16.0.0, 15.1.4, 14.1.4.4, 13.1.5 |
857633-4 | 3-Major | BT857633 | Attack Type (SSRF) appears incorrectly in REST result | 16.0.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
842013-5 | 3-Major | BT842013 | ASM Configuration is Lost on License Reactivation★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
818889-4 | 3-Major | BT818889 | False positive malformed json or xml violation. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
785873-1 | 3-Major | BT785873 | ASM should treat 'Authorization: Negotiate TlR' as NTLM | 15.1.0, 14.1.4.5, 13.1.5 |
767057-3 | 3-Major | BT767057 | In a sync-only device group, inactive policy is synced to peer, ASM is removed from virtual server | 15.1.0, 14.1.4.4, 13.1.5 |
753715-3 | 3-Major | BT753715 | False positive JSON max array length violation | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
731168-2 | 3-Major | BT731168 | BIG-IP may attempt to write to an out of bounds memory location, causing the bd daemon to crash. | 15.0.0, 14.1.4.5, 13.1.5 |
712336-2 | 3-Major | BT712336 | bd daemon restart loop | 15.0.0, 14.1.4.4, 13.1.5, 12.1.5.3 |
1072197-4 | 3-Major | K94142349, BT1072197 | Issue with input normalization in WebSocket. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1067285-4 | 3-Major | BT1067285 | Re-branding - Change 'F5 Networks, Inc.' to 'F5, Inc.' | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1060933-4 | 3-Major | Issue with input normalization. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 | |
1051213-4 | 3-Major | BT1051213 | Increase default value for violation 'Check maximum number of headers'. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1051209-4 | 3-Major | K53593534, BT1051209 | BD may not process certain HTTP payloads as expected | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1043385-1 | 3-Major | BT1043385 | No Signature detected If Authorization header is missing padding. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1042069-4 | 3-Major | Some signatures are not matched under specific conditions. | 17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5, 13.1.5 | |
1038733-1 | 3-Major | BT1038733 | Attack signature not detected for unsupported authorization types. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1037457-4 | 3-Major | BT1037457 | High CPU during specific dos mitigation | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1031445 | 3-Major | BT1031445 | Intermittent false positive unparseable request violations with unknown authorization | 13.1.5 |
1030853-4 | 3-Major | BT1030853 | Route domain IP exception is being treated as trusted (for learning) after being deleted | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1023993-1 | 3-Major | BT1023993 | Brute Force is not blocking requests, even when auth failure happens multiple times | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1022269-4 | 3-Major | BT1022269 | False positive RFC compliant violation | 17.0.0, 16.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
1011069-5 | 3-Major | BT1011069 | Group/User R/W permissions should be changed for .pid and .cfg files. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1004069-3 | 3-Major | BT1004069 | Brute force attack is detected too soon | 17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5 |
944441-4 | 4-Minor | BT944441 | BD_XML logs memory usage at TS_DEBUG level | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
941249-1 | 4-Minor | BT941249 | Improvement to getcrc tool to print cookie names when cookie attributes are involved | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
844045-1 | 4-Minor | BT844045 | ASM Response event logging for "Illegal response" violations. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1055453-1 | 4-Minor | BT1055453 | Blocking page trims the last digit of the Support ID. | 14.1.4.6, 13.1.5 |
1050697-1 | 4-Minor | Traffic learning page counts Disabled signatures when they are ready to be enforced | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 | |
1038741-1 | 4-Minor | BT1038741 | NTLM type-1 message triggers "Unparsable request content" violation. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1036521-5 | 4-Minor | BT1036521 | TMM crash in certain cases | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1034941-4 | 4-Minor | BT1034941 | Exporting and then re-importing "some" XML policy does not load the XML content-profile properly | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1020717-1 | 4-Minor | BT1020717 | Policy versions cleanup process sometimes removes newer versions | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
932137-3 | 3-Major | BT932137 | AVR data might be restored from non-relevant files in /shared/avr_afm partition during upgrade | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
926341-4 | 3-Major | BT926341 | RtIntervalSecs parameter in /etc/avr/avrd.cfg file is reset on version upgrade★ | 17.0.0, 16.1.3.1, 15.1.4, 14.1.4.4, 13.1.5 |
922105-5 | 3-Major | BT922105 | Avrd core when connection to BIG-IQ data collection device is not available | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
909161-5 | 3-Major | BT909161 | A core file is generated upon avrd process restart or stop | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
832805-3 | 3-Major | BT832805 | AVR should make sure file permissions are correct (tmstat_tables.xml) | 16.0.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
787677-1 | 3-Major | BT787677 | AVRD stays at 100% CPU constantly on some systems | 16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5 |
1038913-1 | 3-Major | The weekly ASM reporting "Security ›› Reporting : Application : Charts" filter "View By" as IP Intelligence shows only the "Safe" category | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 | |
1035133-1 | 3-Major | BT1035133 | Statistics data are partially missing in various BIG-IQ graphs under "Monitoring" tab | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
948113-5 | 4-Minor | BT948113 | User-defined report scheduling fails | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
579219-1 | 2-Critical | BT579219 | Access keys missing from SessionDB after multi-blade reboot. | 16.0.0, 15.1.1, 14.1.2.8, 13.1.5 |
827393-4 | 3-Major | BT827393 | In rare cases tmm crash is observed when using APM as RDG proxy. | 17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5 |
470346-4 | 3-Major | BT470346 | Some IPv6 client connections get RST when connecting to APM virtual | 16.0.0, 15.1.4, 14.1.4.3, 13.1.5 |
423519-1 | 3-Major | K74302282, BT423519 | Bypass disabling the redirection controls configuration of APM RDP Resource. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1007629-3 | 3-Major | BT1007629 | APM policy configured with many ACL policies can create APM memory pressure | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
1002557-4 | 3-Major | BT1002557 | Tcl free object list growth | 16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1012721-3 | 2-Critical | BT1012721 | Tmm may crash with SIP-ALG deployment in a particular race condition | 17.0.0, 16.1.1, 15.1.4.1, 14.1.4.4, 13.1.5 |
996113-5 | 3-Major | BT996113 | SIP messages with unbalanced escaped quotes in headers are dropped | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
957905-4 | 3-Major | BT957905 | SIP Requests / Responses over TCP without content_length header are not aborted by BIG-IP. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
805821-5 | 3-Major | BT805821 | GTP log message contains no useful information | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
919301-5 | 4-Minor | BT919301 | GTP::ie count does not work with -message option | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913413-5 | 4-Minor | BT913413 | 'GTP::header extension count' iRule command returns 0 | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913409-5 | 4-Minor | BT913409 | GTP::header extension command may abort connection due to unreasonable TCL error | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913393-5 | 5-Cosmetic | BT913393 | Tmsh help page for GTP iRule contains incorrect and missing information | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1049229-4 | 2-Critical | BT1049229 | When you try to create a sub-rule under the Network Firewall rule list, the error: 'No Access' displays. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
756595-2 | 1-Blocking | BT756595 | Traffic redirection to an internal virtual server may fail. | 15.0.0, 14.1.4.6, 13.1.5 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
873617-4 | 3-Major | BT873617 | DataSafe is not available with AWAF license after BIG-IP startup or MCP restart. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1023437-5 | 3-Major | Buffer overflow during attack with large HTTP Headers | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 | |
1060409-1 | 4-Minor | BT1060409 | Behavioral DoS enable checkbox is wrong. | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
686783-4 | 4-Minor | BT686783 | UlrCat custom database feed list does not work when the URL contains a www prefix or capital letters. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
In-tmm monitors Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
944121-2 | 3-Major | BT944121 | Missing SNI information when using non-default domain https monitor running in TMM mode. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Cumulative fixes from BIG-IP v13.1.4.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
989009-5 | CVE-2021-23033 | K05314769, BT989009 | BD daemon may crash while processing WebSocket traffic | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1 |
980125-5 | CVE-2021-23030 | K42051445, BT980125 | BD Daemon may crash while processing WebSocket traffic | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1 |
935433-5 | CVE-2021-23026 | K53854428, BT935433 | iControl SOAP | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1 |
794561-4 | CVE-2020-5874 | K46901953, BT794561 | TMM may crash while processing JWT/OpenID traffic. | 15.1.0, 15.0.1.3, 14.1.2.5, 14.0.1.1, 13.1.4.1 |
968349-4 | CVE-2021-23048 | K19012930, BT968349 | TMM crashes with unspecified message | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1 |
965485-1 | CVE-2019-5482 | K41523201 | CVE-2019-5482 Heap buffer overflow in the TFTP protocol handler in cURL | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
950017-4 | CVE-2021-23045 | K94941221, BT950017 | TMM may crash while processing SCTP traffic | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1 |
949889-1 | CVE-2019-3900 | K04107324, BT949889 | CVE-2019-3900: An infinite loop issue was found in the vhost_net kernel module while handling incoming packets in handle_rx() | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
942701-4 | CVE-2021-23044 | K35408374, BT942701 | TMM may consume excessive resources while processing HTTP traffic | 16.1.0, 15.1.3.1, 14.1.4.2, 13.1.4.1 |
937365-5 | CVE-2021-23041 | K42526507, BT937365 | LTM UI does not follow best practices | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1 |
907245-4 | CVE-2021-23040 | K94255403, BT907245 | AFM UI Hardening | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1 |
906377-5 | CVE-2021-23038 | K61643620, BT906377 | iRulesLX hardening | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.2, 13.1.4.1 |
842829-5 | CVE-2018-16300 CVE-2018-14881 CVE-2018-14882 CVE-2018-16230 CVE-2018-16229 CVE-2018-16227 CVE-2019-15166 CVE-2018-16228 CVE-2018-16451 CVE-2018-16452 CVE-2018-10103 CVE-2018-10105 CVE-2018-14468 | K04367730, BT842829 | Multiple tcpdump vulnerabilities | 16.0.0, 15.1.3, 14.1.3.1, 13.1.4.1 |
803933-4 | CVE-2018-20843 | K51011533, BT803933 | Expat XML parser vulnerability CVE-2018-20843 | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1 |
797769-3 | CVE-2019-11599 | K51674118 | Linux vulnerability : CVE-2019-11599 | 16.1.0, 16.0.1.2, 15.1.4, 13.1.4.1 |
968733-4 | CVE-2018-1120 | K42202505, BT968733 | CVE-2018-1120 kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 |
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
995629-1 | 2-Critical | BT995629 | Loading UCS files may hang if ASM is provisioned★ | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4.1 |
990849-4 | 2-Critical | BT990849 | Loading UCS with platform-migrate option hangs and requires exiting from the command★ | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4.1 |
967905-1 | 2-Critical | BT967905 | Attaching a static bandwidth controller to a virtual server chain can cause tmm to crash | 17.0.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 |
1000973-1 | 2-Critical | BT1000973 | Unanticipated restart of TMM due to heartbeat failure | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 |
994801-5 | 3-Major | SCP file transfer system | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1 | |
756820-1 | 3-Major | BT756820 | Non-UTF8 characters returned from /bin/createmanifest | 15.0.0, 13.1.4.1 |
713708 | 3-Major | BT713708 | Update Check for EPSEC shows OPSWAT description without EPSEC version on GUI | 14.1.0, 13.1.4.1 |
819053-4 | 4-Minor | CVE-2019-13232 unzip: overlapping of files in ZIP container | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 | |
1004417-2 | 4-Minor | BT1004417 | Provisioning error message during boot up★ | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
754143-2 | 2-Critical | K45456231, BT754143 | TCP connection may hang after FIN | 15.0.0, 14.1.0.2, 13.1.4.1 |
760050-4 | 3-Major | BT760050 | "cwnd too low" warning message seen in logs | 16.0.0, 15.1.4, 14.1.2.7, 13.1.4.1 |
752530-3 | 3-Major | BT752530 | TCP Analytics: Fast L4 TCP Analytics reports incorrect goodput. | 15.0.0, 14.1.2.7, 13.1.4.1 |
752334-3 | 3-Major | BT752334 | Out-of-order packet arrival may cause incorrect Fast L4 goodput calculation | 15.0.0, 14.1.2.7, 13.1.4.1 |
962433-2 | 4-Minor | BT962433 | HTTP::retry for a HEAD request fails to create new connection | 15.1.4, 14.1.4.3, 13.1.4.1 |
962177-4 | 4-Minor | BT962177 | Results of POLICY::names and POLICY::rules commands may be incorrect | 17.0.0, 16.0.1.2, 15.1.4, 14.1.4, 13.1.4.1 |
830833-3 | 4-Minor | BT830833 | HTTP PSM blocking resets should have better log messages | 15.1.0, 15.0.1.1, 14.1.2.5, 13.1.4.1 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
918597-1 | 2-Critical | BT918597 | Under certain conditions, deleting a topology record can result in a crash. | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
973261-5 | 3-Major | BT973261 | GTM HTTPS monitor w/ SSL cert fails to open connections to monitored objects | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
912001-1 | 3-Major | BT912001 | TMM cores on secondary blades of the Chassis system. | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
863917-4 | 3-Major | BT863917 | The list processing time (xx seconds) exceeded the interval value. There may be too many monitor instances configured with a xx second interval. | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.5, 13.1.4.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
996381-5 | 2-Critical | K41503304, BT996381 | ASM attack signature may not match as expected | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1 |
968421-5 | 2-Critical | K30291321, BT968421 | ASM attack signature doesn't matched | 16.1.0, 16.0.1.2, 15.1.2.1, 14.1.4.2, 13.1.4.1, 12.1.6, 11.6.5.3 |
943913-5 | 2-Critical | K30150004, BT943913 | ASM attack signature does not match | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.2, 13.1.4.1 |
1017645-4 | 2-Critical | BT1017645 | False positive HTTP compliance violation | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1 |
955017-5 | 3-Major | BT955017 | Excessive CPU consumption by asm_config_event_handler | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1 |
950917-3 | 3-Major | BT950917 | Apply Policy fails due to internal signature overlap following ASU ASM-SignatureFile_20200917_175034 | 17.0.0, 15.1.4, 14.1.4.2, 13.1.4.1 |
928685-4 | 3-Major | K49549213, BT928685 | ASM Brute Force mitigation not triggered as expected | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1 |
907337-5 | 3-Major | BT907337 | BD crash on specific scenario | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
888289-4 | 3-Major | BT888289 | Add option to skip percent characters during normalization | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
830341-4 | 3-Major | BT830341 | False positives Mismatched message key on ASM TS cookie | 17.0.0, 16.1.2.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
792341-4 | 3-Major | BT792341 | Google Analytics shows incorrect stats. | 15.1.0, 14.1.4.2, 13.1.4.1 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
932485-1 | 3-Major | BT932485 | Incorrect sum(hits_count) value in aggregate tables | 17.0.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
913085-5 | 3-Major | BT913085 | Avrd core when avrd process is stopped or restarted | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
889497-1 | 2-Critical | BT889497 | Deleting a log profile results in urldb and urldbmgrd CPU utilization increase to over 90% usage | 13.1.4.1 |
866109-4 | 3-Major | BT866109 | JWK keys frequency does not support fewer than 60 minutes | 16.0.0, 15.1.4, 14.1.4.2, 13.1.4.1 |
673748-2 | 3-Major | K19534801, BT673748 | ng_export, ng_import might leave security.configpassword in invalid state | 14.0.0, 13.1.4.1, 12.1.3.2 |
747234-4 | 4-Minor | BT747234 | Macro policy does not find corresponding access-profile directly | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
685888-1 | 4-Minor | BT685888 | OAuth client stores incorrectly escaped JSON values in session variables | 14.0.0, 13.1.4.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
868781-3 | 2-Critical | BT868781 | TMM crashes while processing MRF traffic | 16.0.0, 15.1.1, 14.1.4.2, 13.1.4.1 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
948573-3 | 3-Major | BT948573 | Wr_urldbd list of valid TLDs needs to be updated | 16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
Cumulative fixes from BIG-IP v13.1.4 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
980809-4 | CVE-2021-23031 | K41351250, BT980809 | ASM REST Signature Rule Keywords Tool Hardening | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6, 11.6.5.3 |
962341-3 | CVE-2021-23028 | K00602225, BT962341 | BD crash while processing JSON content | 16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.2, 13.1.4 |
882633-5 | CVE-2021-23008 | K51213246, BT882633 | Active Directory authentication does not follow current best practices | 16.1.0, 15.1.3, 14.1.4, 13.1.4, 12.1.6 |
754855-4 | CVE-2020-27714 | K60344652, BT754855 | TMM may crash while processing FastL4 traffic with the Protocol Inspection Profile | 16.0.0, 15.1.1, 14.1.3.1, 13.1.4 |
990333-3 | CVE-2021-23016 | K75540265, BT990333 | APM may return unexpected content when processing HTTP requests | 17.0.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4 |
945109-5 | CVE-2015-9382 | K46641512, BT945109 | Freetype Parser Skip Token Vulnerability CVE-2015-9382 | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6, 11.6.5.3 |
938233-4 | CVE-2021-23042 | K93231374 | An unspecified traffic pattern can lead to high memory accumulation and high CPU utilization | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4, 12.1.6 |
932697-1 | CVE-2021-23000 | K34441555, BT932697 | BIG-IP TMM vulnerability CVE-2021-23000 | 14.1.4, 13.1.4, 12.1.5.3 |
877109-5 | CVE-2021-23012 | K04234247 | Unspecified input can break intended functionality in iHealth proxy | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4 |
718189-2 | CVE-2021-23011 | K10751325, BT718189 | Unspecified IP traffic can cause low-memory conditions | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4, 12.1.6, 11.6.5.3 |
1003557-5 | CVE-2021-23015 | K74151369, BT1003557 | Not following best practices in Guided Configuration Bundle Install worker | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4 |
1002561-4 | CVE-2021-23007 | K37451543, BT1002561 | TMM vulnerability CVE-2021-23007 | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6 |
838909-6 | CVE-2020-5893 | K97733133, BT838909 | BIG-IP APM Edge Client vulnerability CVE-2020-5893 | 15.1.0.2, 14.1.2.4, 13.1.4, 12.1.5.2, 11.6.5.2 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
912289-4 | 2-Critical | BT912289 | Cannot roll back after upgrading on certain platforms★ | 16.0.0, 15.1.1, 14.1.4, 13.1.4, 12.1.6 |
933777-3 | 3-Major | BT933777 | Context use and syntax changes clarification | 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4 |
913829-2 | 3-Major | BT913829 | i15000, i15800, i5000, i7000, i10000, i11000 and B4450 blades may lose efficiency when source ports form an arithmetic sequence | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
794417-2 | 3-Major | BT794417 | Modifying enforce-tls-requirements to enabled on the HTTP/2 profile when renegotiation is enabled on the client-ssl profile should cause validation failure but does not★ | 16.1.3, 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
719338-4 | 4-Minor | BT719338 | Concurrent management SSH connections are unlimited | 16.1.0, 15.1.1, 14.1.4, 13.1.4 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
915305-2 | 2-Critical | BT915305 | Point-to-point tunnel flows do not refresh connection entries; traffic dropped/discarded | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.4 |
888341-3 | 2-Critical | BT888341 | HA Group failover may fail to complete Active/Standby state transition | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
886693-1 | 2-Critical | BT886693 | System might become unresponsive after upgrading.★ | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
785017-4 | 2-Critical | BT785017 | Secondary blades go offline after new primary is elected | 16.1.0, 15.1.3, 14.1.4, 13.1.4 |
743975-2 | 2-Critical | BT743975 | TMM crash (SIGFPE) when starting on a vCMP guest | 14.1.0, 13.1.4, 12.1.6 |
967745-4 | 3-Major | BT967745 | Last resort pool error for the modify command for Wide IP | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.4 |
922297-4 | 3-Major | BT922297 | TMM does not start when using more than 11 interfaces with more than 11 vCPUs | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4 |
838901-1 | 3-Major | BT838901 | TMM receives invalid rx descriptor from HSB hardware | 16.0.0, 15.1.2, 14.1.4, 13.1.4 |
829821-4 | 3-Major | BT829821 | Mcpd may miss its high availability (HA) heartbeat if a very large amount of pool members are configured | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4 |
829317-1 | 3-Major | BT829317 | Memory leak in icrd_child due to concurrent REST usage | 16.0.0, 15.1.0.2, 14.1.3.1, 14.1.3, 13.1.4 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
922317-1 | 2-Critical | BT922317 | Using the LSN::persistence_entry command in an iRule may cause crashes and/or stalled connections | 13.1.4, 12.1.6 |
920265 | 2-Critical | BT920265 | TMM may crash if a virtual server undergoes a series of specific configuration changes involving the transparent-nexthop option. | 13.1.4 |
876801-1 | 2-Critical | BT876801 | Tmm crash: invalid route type | 16.0.0, 15.1.2, 14.1.4, 13.1.4 |
953845-5 | 3-Major | BT953845 | After re-initializing the onboard FIPS HSM, BIG-IP may lose access after second MCPD restart | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4, 12.1.6 |
926929-1 | 3-Major | BT926929 | RFC Compliance Enforcement lacks configuration availability | 16.1.0, 16.0.1.2, 15.1.2.1, 14.1.4, 13.1.4 |
919049 | 3-Major | BT919049 | Guest fails to come up when vCMP guest and host both run BIG-IP v13.1.3.3, assigning FIPS partition | 13.1.4 |
889601-5 | 3-Major | K14903688, BT889601 | OCSP revocation not properly checked | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
888517-4 | 3-Major | BT888517 | Network Driver Abstraction Layer (NDAL) busy polling leads to high CPU.★ | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4 |
858701-4 | 3-Major | BT858701 | Running config and saved config are having different route-advertisement values after upgrading from 11.x/12.x★ | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
825689-5 | 3-Major | Enhance FIPS crypto-user storage | 16.0.0, 15.1.1, 14.1.4, 13.1.4, 12.1.6 | |
809597-1 | 3-Major | BT809597 | Memory leak in icrd_child observed during REST usage | 16.0.0, 15.1.0.2, 14.1.3, 13.1.4 |
784565-4 | 3-Major | BT784565 | VLAN groups are incompatible with fast-forwarded flows | 15.1.0, 15.0.1.1, 13.1.4, 12.1.5.2, 11.6.5.3 |
763093-1 | 3-Major | BT763093 | LRO packets are not taken into account for ifc_stats (VLAN stats) | 15.1.0, 13.1.4 |
773253-2 | 4-Minor | BT773253 | The BIG-IP may send VLAN failsafe probes from a disabled blade | 16.0.0, 15.1.2.1, 14.1.4.2, 13.1.4 |
724746-1 | 4-Minor | BT724746 | Incorrect RST message after 'reject' command | 14.1.0, 13.1.4 |
693901-4 | 4-Minor | BT693901 | Active FTP data connection may change source port on client-side | 14.1.0, 13.1.4, 12.1.6, 11.6.5.3 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
858973-4 | 3-Major | BT858973 | DNS request matches less specific WideIP when adding new wildcard wideips | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
712335-1 | 4-Minor | BT712335 | GTMD may intermittently crash under unusual conditions. | 15.1.0, 14.1.2.7, 13.1.4, 12.1.6 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
941621-4 | 3-Major | K91414704, BT941621 | Brute Force breaks server's Post-Redirect-Get flow | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4 |
929001-5 | 3-Major | K48321015, BT929001 | ASM form handling improvements | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6, 11.6.5.3 |
846057-1 | 3-Major | BT846057 | UCS backup archive may include unnecessary files | 16.0.0, 15.1.3, 14.1.4, 13.1.4 |
673272-5 | 3-Major | BT673272 | Search by "Signature ID is" does not return results for some signature IDs | 17.0.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4 |
824093-1 | 4-Minor | BT824093 | Parameters payload parser issue | 16.0.0, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6, 11.6.5.3 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
981385-5 | 3-Major | BT981385 | AVRD does not send HTTP events to BIG-IQ DCD | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4 |
949593-1 | 3-Major | BT949593 | Unable to load config if AVR widgets were created under '[All]' partition★ | 17.0.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
628645 | 3-Major | BT628645 | Classification signatures fails to update and there are no errors in the GUI★ | 13.1.4 |
Cumulative fixes from BIG-IP v13.1.3.6 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
975233-4 | CVE-2021-22992 | K52510511, BT975233 | Advanced WAF/ASM buffer-overflow vulnerability CVE-2021-22992 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
973333-2 | CVE-2021-22991 | K56715231, BT973333 | TMM buffer-overflow vulnerability CVE-2021-22991 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
955145-4 | CVE-2021-22986 | K03009991, BT955145 | iControl REST unauthenticated remote command execution vulnerability CVE-2021-22986 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
954381-4 | CVE-2021-22986 | K03009991, BT954381 | iControl REST unauthenticated remote command execution vulnerability CVE-2021-22986 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
953677-4 | CVE-2021-22987, CVE-2021-22988 | K18132488 K70031188, BT953677 | TMUI authenticated remote command execution vulnerabilities CVE-2021-22987 and CVE-2021-22988 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3 |
950077-4 | CVE-2021-22987, CVE-2021-22988 | K18132488 K70031188, BT950077 | TMUI authenticated remote command execution vulnerabilities CVE-2021-22987 and CVE-2021-22988 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
981169-4 | CVE-2021-22994 | K66851119, BT981169 | F5 TMUI XSS vulnerability CVE-2021-22994 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
959121-1 | CVE-2021-23015 | K74151369, BT959121 | Not following best practices in Guided Configuration Bundle Install worker | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
953729-4 | CVE-2021-22989, CVE-2021-22990 | K56142644 K45056101, BT953729 | Advanced WAF/ASM TMUI authenticated remote command execution vulnerabilities CVE-2021-22989 and CVE-2021-22990 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
949933-3 | CVE-2021-22980 | K29282483, BT949933 | BIG-IP APM CTU vulnerability CVE-2021-22980 | 16.1.0, 16.0.1.1, 15.1.4, 14.1.4, 13.1.3.6 |
941449-5 | CVE-2021-22993 | K55237223, BT941449 | BIG-IP Advanced WAF and ASM XSS vulnerability CVE-2021-22993 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
931837-3 | CVE-2020-13817 | K55376430, BT931837 | NTP has predictable timestamps | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
931513-4 | CVE-2021-22977 | K14693346, BT931513 | TMM vulnerability CVE-2021-22977 | 16.1.0, 16.0.1.1, 15.1.1, 14.1.3.1, 13.1.3.6 |
921337-1 | CVE-2021-22976 | K88230177, BT921337 | BIG-IP ASM WebSocket vulnerability CVE-2021-22976 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
916821-5 | CVE-2021-22974 | K68652018, BT916821 | iControl REST vulnerability CVE-2021-22974 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6 |
834257-5 | CVE-2020-5931 | K25400442, BT834257 | TMM may crash when processing HTTP traffic | 16.0.0, 15.1.1, 14.1.2.5, 13.1.3.6 |
976925-4 | CVE-2021-23002 | K71891773, BT976925 | BIG-IP APM VPN vulnerability CVE-2021-23002 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6 |
948769-3 | CVE-2021-23013 | K05300051, BT948769 | TMM panic with SCTP traffic | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6, 12.1.5.3 |
939845-4 | CVE-2021-23004 | K31025212, BT939845 | BIG-IP MPTCP vulnerability CVE-2021-23004 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
939841-4 | CVE-2021-23003 | K43470422, BT939841 | BIG-IP MPTCP vulnerability CVE-2021-23003 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
937637-5 | CVE-2021-23002 | K71891773, BT937637 | BIG-IP APM VPN vulnerability CVE-2021-23002 | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
935401-5 | CVE-2021-23001 | K06440657, BT935401 | BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2021-23001 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
832757-4 | CVE-2017-18551 | K48073202, BT832757 | Linux kernel vulnerability CVE-2017-18551 | 15.1.3, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
743105-6 | CVE-2021-22998 | K31934524, BT743105 | BIG-IP SNAT vulnerability CVE-2021-22998 | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
693360-5 | CVE-2020-27721 | K52035247, BT693360 | A virtual server status changes to yellow while still available | 16.1.0, 16.0.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
825413-1 | CVE-2021-23053 | K36942191, BT825413 | ASM may consume excessive resources when matching signatures | 16.0.0, 15.1.3, 14.1.3.1, 13.1.3.6 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
742860 | 3-Major | BT742860 | VE: Predictable NIC ordering based on PCI coordinates until ordering is saved. | 15.1.0, 14.1.4, 13.1.3.6 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
940021-1 | 2-Critical | BT940021 | Syslog-ng hang may lead to unexpected reboot | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6 |
769169-1 | 2-Critical | BT769169 | BIG-IP system with large configuration becomes unresponsive with BIG-IQ monitoring | 15.1.0, 14.1.2.5, 14.0.0.5, 13.1.3.6 |
737322-4 | 2-Critical | BT737322 | tmm may crash at startup if the configuration load fails | 13.1.3.6, 12.1.5.3 |
703039-2 | 2-Critical | BT703039 | Empty results on /tm/sys/config-diff/stats | 14.0.0, 13.1.3.6 |
930741-4 | 3-Major | BT930741 | Truncated or incomplete upload of a BIG-IP image causes kernel lockup and reboot | 16.1.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
927941-2 | 3-Major | BT927941 | IPv6 static route BFD does not come up after OAMD restart | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
913433-4 | 3-Major | BT913433 | On blade failure, some trunked egress traffic is dropped. | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
896553-4 | 3-Major | BT896553 | On blade failure, some trunked egress traffic is dropped. | 16.0.0, 15.1.3, 14.1.4, 13.1.3.6 |
867181-4 | 3-Major | BT867181 | ixlv: double tagging is not working | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
865241-4 | 3-Major | BT865241 | Bgpd might crash when outputting the results of a tmsh show command: "sh bgp ipv6 ::/0" | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
843597-4 | 3-Major | BT843597 | Ensure the system does not set the VE's MTU higher than the vmxnet3 driver can handle | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
842189-3 | 3-Major | BT842189 | Tunnels removed when going offline are not restored when going back online | 16.0.0, 15.1.2.1, 14.1.2.7, 13.1.3.6, 12.1.5.3 |
829193-5 | 3-Major | BT829193 | REST system unavailable due to disk corruption | 16.0.0, 15.1.0.4, 14.1.3.1, 13.1.3.6 |
820845-1 | 3-Major | BT820845 | Self-IP does not respond to ( ARP / Neighbour Discovery ) when EtherIP tunnels in use. | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
759596-3 | 3-Major | BT759596 | Tcl errors in iRules 'table' command | 15.0.0, 14.1.4, 13.1.3.6, 12.1.5.3 |
754132-3 | 3-Major | BT754132 | A NLRI with a default route information is not propagated on 'clear ip bgp <neighbor router-id> soft out' command | 15.0.0, 14.1.4, 13.1.3.6 |
749007-3 | 3-Major | BT749007 | South Sudan is missing in the GTM region list | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
744252-3 | 3-Major | BT744252 | BGP route map community value: either component cannot be set to 65535 | 15.0.0, 14.1.4, 13.1.3.6 |
933461-2 | 4-Minor | BT933461 | BGP multi-path candidate selection does not work properly in all cases. | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
892677-3 | 4-Minor | BT892677 | Loading config file with imish adds the newline character | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6 |
800193 | 4-Minor | BT800193 | Update OpenSSH to version 7 or later for disabling of DSA keys | 13.1.3.6 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
726518-4 | 2-Critical | BT726518 | Tmsh show command terminated with CTRL-C can cause TMM to crash. | 16.0.0, 15.1.2, 14.1.2.8, 13.1.3.6 |
705768-5 | 2-Critical | BT705768 | The dynconfd process may core and restart with multiple DNS name servers configured | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.2 |
949145-3 | 3-Major | BT949145 | Improve TCP's response to partial ACKs during loss recovery | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
879413-4 | 3-Major | BT879413 | Statsd fails to start if one or more of its *.info files becomes corrupted | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
860005-4 | 3-Major | BT860005 | Ephemeral nodes/pool members may be created for wrong FQDN name | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.2 |
857845-5 | 3-Major | BT857845 | TMM crashes when 'server drained' or 'client drained' errors are triggered via an iRule | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
851045-4 | 3-Major | BT851045 | LTM database monitor may hang when monitored DB server goes down | 16.0.0, 15.1.1, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
814761-3 | 3-Major | BT814761 | PostgreSQL monitor fails on second ping with count != 1 | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.6, 12.1.5.3 |
805017-3 | 3-Major | BT805017 | DB monitor marks pool member down if no send/recv strings are configured | 15.1.0, 15.0.1.3, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
803233-4 | 3-Major | BT803233 | Pool may temporarily become empty and any virtual server that uses that pool may temporarily become unavailable | 16.1.0, 16.0.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.2 |
772545-1 | 3-Major | BT772545 | Tmm core in SSLO environment | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.6 |
759056-1 | 3-Major | BT759056 | stpd memory leak on secondary blades in a multi-blade system | 15.0.0, 14.1.3.1, 13.1.3.6 |
747077-1 | 3-Major | BT747077 | Potential crash in TMM when updating pool members | 13.1.3.6 |
745682-2 | 3-Major | BT745682 | Failed to parse X-Forwarded-For header in HTTP requests | 15.0.0, 14.1.3.1, 13.1.3.6 |
722707-4 | 3-Major | BT722707 | mysql monitor debug logs incorrectly report responses from 'DB' when packets dropped by firewall | 15.0.0, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
720440-1 | 3-Major | BT720440 | Radius monitor marks pool members down after 6 seconds | 16.0.0, 15.1.0.5, 14.1.3.1, 13.1.3.6, 12.1.5.2 |
714642-1 | 3-Major | BT714642 | Ephemeral pool-member state on the standby is down | 16.1.0, 16.0.1.1, 15.1.2, 14.1.4, 13.1.3.6 |
705387 | 3-Major | BT705387 | HTTP/2, ALPN and SSL | 13.1.3.6 |
686062-1 | 3-Major | BT686062 | The dynconfd daemon uses UDP ports inefficiently | 14.0.0, 13.1.3.6 |
608952-4 | 3-Major | BT608952 | MSSQL health monitors fail when SQL server requires TLSv1.1 or TLSv1.2 | 16.0.0, 15.1.5, 14.1.2.7, 13.1.3.6, 12.1.5.3 |
824365-1 | 4-Minor | BT824365 | Need informative messages for HTTP iRule runtime validation errors | 16.0.0, 15.1.0.2, 15.0.1.1, 14.1.2.3, 13.1.3.6 |
822025-4 | 4-Minor | BT822025 | HTTP response not forwarded to client during an early response | 15.1.0.2, 15.0.1.4, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
808409-1 | 4-Minor | BT808409 | Unable to specify if giaddr will be modified in DHCP relay chain | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
801705-2 | 4-Minor | BT801705 | When inserting a cookie or a cookie attribute, BIG-IP does not add a leading space, required by RFC | 16.0.0, 15.1.5.1, 14.1.3.1, 13.1.3.6 |
738032-2 | 4-Minor | BT738032 | BIG-IP system reuses cached session-id after SSL properties of the monitor has been changed. | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6 |
859717-4 | 5-Cosmetic | BT859717 | ICMP-limit-related warning messages in /var/log/ltm | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
918169-3 | 2-Critical | BT918169 | The GTM/DNS HTTPS monitor may fail to mark a service up when the SSL session undergoes an unclean shutdown. | 16.1.0, 16.0.1.1, 15.1.2, 14.1.2.7, 13.1.3.6 |
921625-5 | 3-Major | BT921625 | The certs extend function does not work for GTM/DNS sync group | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6 |
921549-7 | 3-Major | BT921549 | The gtmd process does not receive updates from local big3d. | 13.1.3.6 |
852101-4 | 3-Major | BT852101 | Monitor fails. | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.6 |
853585-5 | 4-Minor | BT853585 | REST Wide IP object presents an inconsistent lastResortPool value | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.6 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
940249-4 | 2-Critical | BT940249 | Sensitive data is not masked after "Maximum Array/Object Elements" is reached | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.6, 11.6.5.3 |
927617-4 | 2-Critical | BT927617 | 'Illegal Base64 value' violation is detected for cookies that have a valid base64 value | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
940897-4 | 3-Major | BT940897 | Violations are detected for incorrect parameter in case of "Maximum Array/Object Elements" is reached | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.6 |
918933-4 | 3-Major | K88162221, BT918933 | The BIG-IP ASM system may not properly perform signature checks on cookies | 16.1.0, 16.0.1.1, 15.1.2, 14.1.2.8, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
904053-5 | 3-Major | BT904053 | Unable to set ASM Main Cookie/Domain Cookie hashing to Never | 16.1.0, 16.0.1.1, 15.1.2, 14.1.4, 13.1.3.6 |
742549-1 | 3-Major | BT742549 | Cannot create non-ASCII entities in non-UTF ASM policy using REST | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.6 |
767941-2 | 4-Minor | BT767941 | Gracefully handle policy builder errors | 15.1.0, 14.1.4, 13.1.3.6 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
743826-3 | 3-Major | BT743826 | Incorrect error message: "Can't find pool []: Pool was not found" even though Pool member is defined with port any(0) | 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
727031-1 | 1-Blocking | BT727031 | TMM restart in B2250 vCMP systems, and ping/monitor failures in non-B2250 vCMP systems. | 14.1.0, 13.1.3.6, 12.1.5.3 |
896709-1 | 2-Critical | BT896709 | Add support for Restart Desktop for webtop in VMware VDI | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.3.1, 13.1.3.6 |
976501-4 | 3-Major | BT976501 | Failed to establish VPN connection | 16.1.0, 15.1.3, 14.1.4, 13.1.3.6 |
924929 | 3-Major | BT924929 | Logging improvements for VDI plugin | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.3.1, 13.1.3.6 |
914649-1 | 3-Major | BT914649 | Support USB redirection through VVC (VMware virtual channel) with BlastX | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6 |
760629-2 | 3-Major | BT760629 | Remove Obsolete APM keys in BigDB | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
739570-2 | 3-Major | BT739570 | Unable to install EPSEC package★ | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3 |
554228-7 | 3-Major | BT554228 | OneConnect does not work when WEBSSO is enabled/configured. | 13.1.3.6, 12.1.0, 11.6.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
939529-4 | 3-Major | BT939529 | Branch parameter not parsed properly when topmost via header received with comma separated values | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
755854-1 | 3-Major | BT755854 | TMM crash due to missing classification category | 15.0.0, 13.1.3.6 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
927993-5 | 1-Blocking | K97501254, BT927993 | Built-in SSL Orchestrator RPM installation failure | 16.1.0, 16.0.1.1, 15.1.2, 14.1.4, 14.1.3, 13.1.3.6, 12.1.5.3 |
Cumulative fixes from BIG-IP v13.1.3.5 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
943125-4 | CVE-2021-23010 | K18570111, BT943125 | ASM bd may crash while processing WebSocket traffic | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
935721-3 | CVE-2020-8622, CVE-2020-8623, CVE-2020-8624 | K82252291, BT935721 | ISC BIND Vulnerabilities: CVE-2020-8622, CVE-2020-8623, CVE-2020-8624 | 16.1.0, 16.0.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
933741-5 | CVE-2021-22979 | K63497634, BT933741 | BIG-IP FPS XSS vulnerability CVE-2021-22979 | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
933297 | CVE-2020-5949 | K20984059, BT933297 | FTP virtual server passive data channels do not pass traffic | 13.1.3.5 |
932065-4 | CVE-2021-22978 | K87502622, BT932065 | iControl REST vulnerability CVE-2021-22978 | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
917509-1 | CVE-2020-27718 | K58102101, BT917509 | BIG-IP ASM vulnerability CVE-2020-27718 | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
912221-3 | CVE-2020-12662 CVE-2020-12663 |
K37661551, BT912221 | CVE-2020-12662 & CVE-2020-12663 | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.5, 12.1.6, 11.6.5.3 |
911761-5 | CVE-2020-5948 | K42696541, BT911761 | F5 TMUI XSS vulnerability CVE-2020-5948 | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
908673-2 | CVE-2020-27717 | K43850230, BT908673 | TMM may crash while processing DNS traffic | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
891457-5 | CVE-2020-5939 | K75111593, BT891457 | NIC driver may fail while transmitting data | 16.1.0, 16.0.1, 15.1.0.4, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
882189-4 | CVE-2020-5897 | K20346072, BT882189 | BIG-IP Edge Client for Windows vulnerability CVE-2020-5897 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
882185-4 | CVE-2020-5897 | K20346072, BT882185 | BIG-IP Edge Client Windows ActiveX | 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.2 |
881317-3 | CVE-2020-5896 | K15478554, BT881317 | BIG-IP Edge Client for Windows vulnerability CVE-2020-5896 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
881293-4 | CVE-2020-5896 | K15478554, BT881293 | BIG-IP Edge Client for Windows vulnerability CVE-2020-5896 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
879745-5 | CVE-2020-5942 | K82530456 | TMM may crash while processing Diameter traffic | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
879025-6 | CVE-2020-5913 | K72752002, BT879025 | When processing TLS traffic, LTM may not enforce certificate chain restrictions | 16.0.0, 15.1.0.2, 14.1.2.5, 13.1.3.5, 12.1.5.2 |
846917-5 | CVE-2019-10744 | K47105354, BT846917 | lodash Vulnerability: CVE-2019-10744 | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.7, 13.1.3.5, 12.1.5.3 |
839453-2 | CVE-2019-10744 | K47105354, BT839453 | lodash library vulnerability CVE-2019-10744 | 16.0.0, 15.1.1, 14.1.2.7, 13.1.3.5, 12.1.5.2 |
788057-1 | CVE-2020-5921 | K00103216, BT788057 | MCPD may crash while processing syncookies | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5, 12.1.5.2, 11.6.5.3 |
946581 | CVE-2020-27713 | K37960100, BT946581 | TMM vulnerability CVE-2020-27713 | 14.1.4, 13.1.3.5 |
928037-4 | CVE-2020-27729 | K15310332, BT928037 | APM Hardening | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
917005-3 | CVE-2020-8619 | K19807532 | ISC BIND Vulnerability: CVE-2020-8619 | 16.1.0, 16.0.1, 15.1.0.5, 14.1.2.7, 13.1.3.5, 12.1.6, 11.6.5.3 |
912969-5 | CVE-2020-27727 | K50343630, BT912969 | iAppsLX REST vulnerability CVE-2020-27727 | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
909837-3 | CVE-2020-5950 | K05204103, BT909837 | TMM may consume excessive resources when AFM is provisioned | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.5 |
905125-4 | CVE-2020-27726 | K30343902, BT905125 | Security hardening for APM Webtop | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
904937-5 | CVE-2020-27725 | K25595031, BT904937 | Excessive resource consumption in zxfrd | 16.0.0, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
898949-4 | CVE-2020-27724 | K04518313, BT898949 | APM may consume excessive resources while processing VPN traffic | 16.1.0, 16.0.1, 15.1.0.5, 15.0.1.4, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
889557-3 | CVE-2019-11358 | K20455158, BT889557 | jQuery Vulnerability CVE-2019-11358 | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.6, 11.6.5.3 |
881445-4 | CVE-2020-5898 | K69154630, BT881445 | BIG-IP Edge Client for Windows vulnerability CVE-2020-5898 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.2 |
880361-4 | CVE-2021-22973 | K13323323, BT880361 | iRules LX vulnerability CVE-2021-22973 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
856961-4 | CVE-2018-12207 | K17269881, BT856961 | INTEL-SA-00201 MCE vulnerability CVE-2018-12207 | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.8, 13.1.3.5 |
848405-1 | CVE-2020-5933 | K26244025, BT848405 | TMM may consume excessive resources while processing compressed HTTP traffic | 16.0.0, 15.1.1, 14.1.2.5, 13.1.3.5, 12.1.5.2, 11.6.5.2 |
842717-3 | CVE-2020-5855 | K55102004, BT842717 | BIG-IP Edge Client for Windows vulnerability CVE-2020-5855 | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
831777-2 | CVE-2020-27723 | K42933418, BT831777 | Tmm crash in Ping access use case | 15.1.0, 14.1.3.1, 13.1.3.5 |
816413-4 | CVE-2019-1125 | K31085564, BT816413 | CVE-2019-1125: Spectre SWAPGS Gadget | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
811965-3 | CVE-2020-27722 | K73657294, BT811965 | Some VDI use cases can cause excessive resource consumption | 15.1.0, 15.0.1.4, 14.1.3.1, 13.1.3.5 |
778049-6 | CVE-2018-13405 | K00854051, BT778049 | Linux Kernel Vulnerability: CVE-2018-13405 | 16.1.0, 16.0.1, 15.1.1, 15.0.1.4, 14.1.3.1, 13.1.3.5 |
751036-3 | CVE-2020-27721 | K52035247, BT751036 | Virtual server status stays unavailable even after all the over-the-rate-limit connections are gone | 15.1.0, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
888493-5 | CVE-2020-5928 | K40843345, BT888493 | ASM GUI Hardening | 16.1.0, 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5, 12.1.5.2 |
852929-2 | CVE-2020-5920 | K25160703, BT852929 | AFM WebUI Hardening | 16.0.0, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.2, 11.6.5.2 |
818213-6 | CVE-2019-10639 | K32804955, BT818213 | CVE-2019-10639: KASLR bypass using connectionless protocols | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
818177-1 | CVE-2019-12295 | K06725231, BT818177 | CVE-2019-12295 Wireshark Vulnerability | 16.0.0, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
773693-3 | CVE-2020-5892 | K15838353, BT773693 | CVE-2020-5892: APM Client Vulnerability | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 11.6.5.2 |
682352-2 | CVE-2017-3735 | K21462542 | OpenSSL vulnerability CVE-2017-3735 | 14.0.0, 13.1.3.5 |
834533-4 | CVE-2019-15916 | K57418558, BT834533 | Linux kernel vulnerability CVE-2019-15916 | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
890229-4 | 3-Major | BT890229 | Source port preserve setting is not honored | 16.0.0, 15.1.1, 14.1.2.8, 13.1.3.5 |
738330-1 | 3-Major | BT738330 | /mgmt/toc endpoint issue after configuring remote authentication | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.5 |
657912-3 | 3-Major | BT657912 | PIM can be configured to use a floating self IP address | 14.0.0, 13.1.3.5, 12.1.5.3 |
745465-3 | 4-Minor | BT745465 | The tcpdump file does not provide the correct extension | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
749738-2 | 1-Blocking | BT749738 | After upgrade to 13.1.3.3 or 13.1.3.4, B2250 blades may fail to detect HSB and have restarting chmand★ | 15.0.0, 14.1.2.2, 13.1.3.5 |
910201-5 | 2-Critical | BT910201 | OSPF - SPF/IA calculation scheduling might get stuck infinitely | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
896217-5 | 2-Critical | BT896217 | BIG-IP GUI unresponsive | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
860517-4 | 2-Critical | BT860517 | MCPD may crash on startup with many thousands of monitors on a system with many CPUs. | 16.0.0, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
829677-4 | 2-Critical | BT829677 | .tmp files in /var/config/rest/ may cause /var directory exhaustion | 16.1.0, 16.0.1.1, 15.1.2, 14.1.2.7, 13.1.3.5 |
812237-3 | 2-Critical | BT812237 | i10000 series appliances with HDVC part number 505-0030 missing name in show sys hardware and on LCD | 15.1.0, 13.1.3.5, 12.1.6 |
810593-4 | 2-Critical | K10963690, BT810593 | Unencoded sym-unit-key causes guests to go 'INOPERATIVE' after upgrade★ | 15.1.0, 14.1.2.7, 13.1.3.5 |
796601-6 | 2-Critical | BT796601 | Invalid parameter in errdefsd while processing hostname db_variable | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
770989-1 | 2-Critical | BT770989 | Observed '/shared/lib/rpm' RPM database corruption on B4450 blades and iSeries platforms installing 14.1.x.★ | 14.1.3.1, 13.1.3.5 |
769817 | 2-Critical | BT769817 | BFD fails to propagate sessions state change during blade restart | 15.1.0, 15.0.1.4, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.1 |
769581 | 2-Critical | BT769581 | Timeout when sending many large iControl REST requests | 15.1.0, 14.1.2.7, 14.0.0.5, 13.1.3.5 |
706521-5 | 2-Critical | K21404407, BT706521 | The audit forwarding mechanism for TACACS+ uses an unencrypted db variable to store the password | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
649205-1 | 2-Critical | BT649205 | Failure of mcpd during setup of HA communication | 14.0.0, 13.1.3.5 |
924493-5 | 3-Major | BT924493 | VMware EULA has been updated | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
915825-5 | 3-Major | BT915825 | Configuration error caused by Drafts folder in a deleted custom partition while upgrading. | 16.1.0, 15.1.1, 14.1.3.1, 13.1.3.5 |
908021-3 | 3-Major | BT908021 | Management and VLAN MAC addresses are identical | 16.1.0, 15.1.3, 14.1.3.1, 13.1.3.5 |
898705-2 | 3-Major | BT898705 | IPv6 static BFD configuration is truncated or missing | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
888497-5 | 3-Major | BT888497 | Cacheable HTTP Response | 16.1.0, 16.0.1.1, 15.1.0.5, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
887089-5 | 3-Major | BT887089 | Upgrade can fail when filenames contain spaces | 16.1.0, 15.1.0.5, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
871657-3 | 3-Major | BT871657 | Mcpd crash when adding NAPTR GTM pool member with a flag of uppercase A or S | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5, 12.1.5.3 |
867013-5 | 3-Major | BT867013 | Fetching ASM policy list from the GUI (in LTM policy rule creation) occasionally causes REST timeout | 16.0.0, 15.1.1, 14.1.2.7, 13.1.3.5 |
858197-4 | 3-Major | BT858197 | Merged crash when memory exhausted | 16.1.0, 16.0.1.1, 15.1.2, 14.1.2.8, 13.1.3.5 |
846441-4 | 3-Major | BT846441 | Flow-control is reset to default for secondary blade's interface | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
846137-5 | 3-Major | BT846137 | The icrd returns incorrect route names in some cases | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
814585-5 | 3-Major | BT814585 | PPTP profile option not available when creating or modifying virtual servers in GUI | 16.1.0, 16.0.1, 15.1.0.5, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
810821-4 | 3-Major | BT810821 | Management interface flaps after rebooting the device. | 16.0.0, 15.1.2, 14.1.2.7, 13.1.3.5 |
810381-1 | 3-Major | BT810381 | The SNMP max message size check is being incorrectly applied. | 16.0.0, 15.1.0.4, 14.1.2.8, 13.1.3.5 |
808281 | 3-Major | BT808281 | OVA/Azure template sets '/var' partition with not enough space | 13.1.3.5 |
802685-4 | 3-Major | BT802685 | Unable to configure performance HTTP virtual server via GUI | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
802281-4 | 3-Major | BT802281 | Gossip shows active even when devices are missing | 16.0.0, 15.1.0.2, 14.1.2.5, 13.1.3.5 |
797829-3 | 3-Major | BT797829 | The BIG-IP system may fail to deploy new or reconfigure existing iApps | 16.1.0, 16.0.1.1, 15.1.0.5, 14.1.2.8, 13.1.3.5 |
795649-2 | 3-Major | BT795649 | Loading UCS from one iSeries model to another causes FPGA to fail to load | 16.0.0, 15.1.0.3, 14.1.3.1, 13.1.3.5, 12.1.5.2 |
788577 | 3-Major | BT788577 | BFD sessions may be reset after CMP state change | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.2, 11.6.5.2 |
783113 | 3-Major | BT783113 | BGP sessions remain down upon new primary slot election | 15.1.0, 15.0.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3, 11.6.5.2 |
767737-3 | 3-Major | BT767737 | Timing issues during startup may make an HA peer stay in the inoperative state | 16.0.0, 15.1.2.1, 14.1.3.1, 13.1.3.5 |
755197-1 | 3-Major | BT755197 | UCS creation might fail during frequent config save transactions | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
754971-1 | 3-Major | BT754971 | OSPF inter-process redistribution might break OSPF route redistribution of various types. | 15.0.0, 14.1.3.1, 13.1.3.5 |
751021-3 | 3-Major | BT751021 | One or more TMM instances may be left without dynamic routes. | 15.1.0, 14.1.4, 13.1.3.5 |
750194-2 | 3-Major | Moderate: net-snmp security update | 15.0.0, 14.1.4, 13.1.3.5 | |
746704-1 | 3-Major | BT746704 | Syslog-ng Memory Leak | 15.0.0, 14.1.2.8, 13.1.3.5 |
745261-1 | 3-Major | BT745261 | The TMM process may crash in some tunnel cases | 15.0.0, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
740589-3 | 3-Major | BT740589 | Mcpd crash with core after 'tmsh edit /sys syslog all-properties' | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
737098-3 | 3-Major | BT737098 | ASM Sync does not work when the configsync IP address is an IPv6 address | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
725985-1 | 3-Major | BT725985 | REST API takes more than 20 seconds when 1000+ virtual servers with SNAT-Pool configured | 14.1.0, 13.1.3.5 |
720569-1 | 3-Major | BT720569 | Disaggregation algorithm distributing traffic unequally across CPU cores on Virtual Edition | 14.1.0, 13.1.3.5, 12.1.5.3 |
707320-2 | 3-Major | BT707320 | Upgrades from pre-12.0.0 BIG-IPs to 12.0.0 with WideIPs with ipv6-no-error-response enabled will no longer delete AAAA-type WideIPs | 14.0.0, 13.1.3.5 |
705655-2 | 3-Major | BT705655 | Virtual address not responding to ICMP when ICMP Echo set to Selective | 14.1.0, 13.1.3.5 |
699091-2 | 3-Major | BT699091 | SELinux denies console access for remote users. | 14.0.0, 13.1.3.5, 12.1.5.3 |
658716-1 | 3-Major | BT658716 | Failure of mcpd when closing out CMI connection | 14.0.0, 13.1.3.5 |
658715-1 | 3-Major | BT658715 | Mcpd crash | 14.0.0, 13.1.3.5 |
615934-3 | 3-Major | BT615934 | Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors. | 16.1.0, 15.1.3, 14.1.4, 13.1.3.5 |
605675-2 | 3-Major | BT605675 | Sync requests can be generated faster than they can be handled | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.7, 13.1.3.5, 12.1.5.3, 11.6.5.2 |
489572-3 | 3-Major | K60934489, BT489572 | Sync fails if file object is created and deleted before sync to peer BIG-IP | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
431503-6 | 3-Major | K14838, BT431503 | TMSH crashes in rare initial tunnel configurations | 15.1.1, 14.1.2.8, 13.1.3.5, 11.5.0 |
902417-5 | 4-Minor | BT902417 | Configuration error caused by Drafts folder in a deleted custom partition★ | 16.1.0, 16.0.1.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
890277-1 | 4-Minor | BT890277 | Full config sync to a device group operation takes a long time when there are a large number of partitions. | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
864757-1 | 4-Minor | BT864757 | Traps that were disabled are enabled after configuration save | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
831293-2 | 4-Minor | BT831293 | SNMP address-related GET requests slow to respond. | 16.0.0, 15.1.0.2, 14.1.2.7, 13.1.3.5, 12.1.5.3 |
804309-3 | 4-Minor | BT804309 | [api-status-warning] are generated at stderr and /var/log/ltm when listing config with all-properties argument | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.5 |
801637-1 | 4-Minor | BT801637 | Cmp_dest on C2200 platform may give incorrect results | 15.1.0, 13.1.3.5, 12.1.5.3 |
779857-4 | 4-Minor | BT779857 | Misleading GUI error when installing a new version in another partition★ | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
692165-1 | 4-Minor | BT692165 | A request-log profile may not log anything for the $VIRTUAL_POOL_NAME token | 14.0.0, 13.1.3.5, 12.1.5 |
591732-3 | 4-Minor | BT591732 | Local password policy not enforced when auth source is set to a remote type. | 15.1.0, 15.0.1.4, 14.1.3.1, 13.1.3.5, 12.1.5.1 |
583084-10 | 4-Minor | K15101680, BT583084 | iControl produces 404 error while creating records successfully | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5 |
714176-4 | 5-Cosmetic | BT714176 | UCS restore may fail with: Decryption of the field (privatekey) for object (9717) failed | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
941089-4 | 2-Critical | BT941089 | TMM core when using Multipath TCP | 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
851857-4 | 2-Critical | BT851857 | HTTP 100 Continue handling does not work when it arrives in multiple packets | 16.0.0, 15.1.1, 14.1.3.1, 13.1.3.5 |
687603-2 | 2-Critical | K36243347, BT687603 | tmsh query for dns records may cause tmm to crash | 14.0.0, 13.1.3.5, 12.1.3.2, 11.6.5.3 |
951033-1 | 3-Major | BT951033 | Virtual server resets all the connections for rstcause 'VIP disabled (administrative)' | 15.1.0, 14.1.3.1, 13.1.3.5 |
915689-5 | 3-Major | BT915689 | HTTP/2 dynamic header table may fail to identify indexed headers on the response side. | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
915605-4 | 3-Major | K56251674, BT915605 | Image install fails if iRulesLX is provisioned and /usr mounted read-write★ | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5 |
915281-6 | 3-Major | BT915281 | Do not rearm TCP Keep Alive timer under certain conditions | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5, 12.1.5.3 |
909757 | 3-Major | BT909757 | HTTP CONNECT method with a delayed payload can cause a connection to be closed | 13.1.3.5 |
892385-3 | 3-Major | BT892385 | HTTP does not process WebSocket payload when received with server HTTP response | 16.1.0, 16.0.1, 15.1.1, 15.0.1.4, 14.1.3.1, 13.1.3.5 |
862597-3 | 3-Major | BT862597 | Improve MPTCP's SYN/ACK retransmission handling | 16.0.0, 15.1.0.2, 14.1.3.1, 13.1.3.5 |
828601-4 | 3-Major | BT828601 | IPv6 Management route is preferred over IPv6 tmm route | 16.0.0, 15.1.0.3, 14.1.2.7, 13.1.3.5 |
818853-5 | 3-Major | BT818853 | Duplicate MAC entries in FDB | 16.0.0, 15.1.0.2, 14.1.3.1, 13.1.3.5 |
810445-3 | 3-Major | BT810445 | PEM: ftp-data not classified or reported | 15.1.0, 14.1.2.8, 13.1.3.5 |
807821-3 | 3-Major | BT807821 | ICMP echo requests occasionally go unanswered | 13.1.3.5, 12.1.5.3 |
790845-1 | 3-Major | BT790845 | An In-TMM monitor may be incorrectly marked down when CMP-hash setting is not default | 16.0.0, 15.1.2, 14.1.4, 13.1.3.5 |
786517-1 | 3-Major | BT786517 | Modifying a monitor Alias Address from the TMUI might cause failed config loads and send monitors to an incorrect address | 16.0.0, 15.1.0.5, 14.1.3.1, 13.1.3.5 |
783617-4 | 3-Major | BT783617 | Virtual server resets connections when all pool members are marked disabled | 15.1.0, 14.1.3.1, 13.1.3.5 |
766169-3 | 3-Major | BT766169 | Replacing all VLAN interfaces resets VLAN MTU to a default value | 15.1.0, 14.1.2.8, 13.1.3.5, 12.1.5.2 |
758631-2 | 3-Major | BT758631 | ec_point_formats extension might be included in the server hello even if not specified in the client hello | 15.1.0, 14.1.2.5, 14.0.1.1, 13.1.3.5, 12.1.5 |
758599-4 | 3-Major | BT758599 | IPv6 Management route is preferred over IPv6 tmm route | 16.0.0, 15.1.0.3, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
758437-4 | 3-Major | BT758437 | SYN w/ data disrupts stat collection in Fast L4 | 15.0.0, 14.1.2.8, 13.1.3.5 |
758436-2 | 3-Major | BT758436 | Optimistic ACKs degrade Fast L4 statistics | 15.0.0, 14.1.2.8, 13.1.3.5 |
758041-4 | 3-Major | BT758041 | LTM Pool Members may not be updated accurately when multiple identical database monitors are configured. | 16.0.0, 15.1.4.1, 14.1.2.7, 13.1.3.5 |
745923-4 | 3-Major | BT745923 | Connection flow collision can cause packets to be sent with source and/or destination port 0 | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.5 |
745663-2 | 3-Major | BT745663 | During traffic forwarding, nexthop data may be missed at large packet split | 15.1.0, 14.1.2.8, 13.1.3.5 |
724824-4 | 3-Major | BT724824 | Ephemeral nodes on peer devices report as unknown and unchecked after full config sync | 16.0.0, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
710930-1 | 3-Major | BT710930 | Enabling BigDB key bigd.tmm may cause SSL monitors to fail | 15.1.0, 14.1.3.1, 13.1.3.5 |
681814-1 | 3-Major | BT681814 | Changes to a cipher group are not propagated to SSL profiles until the configuration is reloaded | 14.0.0, 13.1.3.5 |
522241-2 | 3-Major | BT522241 | Using tmsh to display the number of elements in a DNS cache may cause high CPU utilization, and the tmsh command may not complete | 15.0.0, 14.1.2.7, 13.1.3.5, 12.1.6, 11.6.5.3 |
814037-1 | 4-Minor | BT814037 | No virtual server name in Hardware Syncookie activation logs. | 16.0.0, 15.1.1, 14.1.2.8, 13.1.3.5 |
781225-3 | 4-Minor | BT781225 | HTTP profile Response Size stats incorrect for keep-alive connections | 15.1.0, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
726983-4 | 4-Minor | BT726983 | Inserting multi-line HTTP header not handled correctly | 15.0.0, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
960749-4 | 1-Blocking | BT960749 | TMM may crash when handling 'DNS Cache' or 'Network DNS Resolver' traffic | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5, 12.1.6, 11.6.5.3 |
960437-4 | 2-Critical | BT960437 | The BIG-IP system may initially fail to resolve some DNS queries | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5, 12.1.6, 11.6.5.3 |
919553-4 | 2-Critical | BT919553 | GTM/DNS monitors based on the TCP protocol may fail to mark a service up when the server's response spans multiple packets. | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5 |
783125-4 | 2-Critical | BT783125 | iRule drop command on DNS traffic without Datagram-LB may cause TMM crash | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
781829-4 | 3-Major | BT781829 | GTM TCP monitor does not check the RECV string if server response string not ending with \n | 15.1.0, 14.1.3.1, 13.1.3.5 |
760471-4 | 3-Major | BT760471 | GTM iQuery connections may be reset during SSL key renegotiation. | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.3, 13.1.3.5, 12.1.5.2 |
758772-4 | 3-Major | BT758772 | DNS Cache RRSET Evictions Stat not increasing | 15.1.0, 14.1.2.7, 13.1.3.5, 12.1.6, 11.6.5.3 |
757464-3 | 3-Major | BT757464 | DNS Validating Resolver Cache 'Key' Cache records not deleted correctly when using TMSH command to delete the record | 15.1.0, 14.1.2.7, 13.1.3.5, 12.1.6, 11.6.5.3 |
708421-2 | 3-Major | K52142743, BT708421 | DNS::question 'set' options are applied to packet, but not to already parsed dns_msg | 15.1.0, 13.1.3.5, 12.1.5.2 |
700118-1 | 3-Major | BT700118 | rrset statistics unavailable | 14.0.0, 13.1.3.5, 12.1.6, 11.6.5.3 |
529896-1 | 3-Major | BT529896 | DNS Cache can use cached data from ADDITIONAL sections in answers after RRset cache cleared | 14.0.0, 13.1.3.5, 12.1.6, 11.6.5.3 |
643455-1 | 4-Minor | BT643455 | Update TTL for equally trusted records only | 14.0.0, 13.1.3.5, 12.1.6, 11.6.5.3 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
903453 | 2-Critical | BT903453 | TMM crash following redirect when Proactive Bot Defense is used | 13.1.3.5 |
941853-3 | 3-Major | BT941853 | Logging Profiles do not disassociate from virtual server when multiple changes are made | 16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
900797-5 | 3-Major | BT900797 | Brute Force Protection (BFP) hash table entry cleanup | 16.1.0, 16.0.1, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
900793-3 | 3-Major | K32055534, BT900793 | APM Brute Force Protection resources do not scale automatically | 16.1.0, 16.0.1, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
900789-5 | 3-Major | BT900789 | Alert before Brute Force Protection (BFP) hash are fully utilized | 16.1.0, 16.0.1, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
848445-4 | 3-Major | K86285055, BT848445 | Global/URL/Flow Parameters with flag is_sensitive true are not masked in Referer★ | 16.0.0, 15.1.0.5, 14.1.2.8, 13.1.3.5, 12.1.5.3, 11.6.5.3 |
833685-1 | 3-Major | BT833685 | Idle async handlers can remain loaded for a long time doing nothing | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.5, 12.1.5.3 |
722337-3 | 3-Major | BT722337 | Always show violations in request log when post request is large | 16.1.0, 16.0.1.1, 15.1.0.5, 14.1.2.7, 13.1.3.5 |
692279-1 | 3-Major | BT692279 | Request logging is briefly suspended after policy re-assignment | 14.0.0, 13.1.3.5 |
424588-1 | 3-Major | BT424588 | iRule command [DOSL7::profile] returns empty value | 14.1.0, 13.1.3.5 |
935293-1 | 4-Minor | BT935293 | 'Detected Violation' Field for event logs not showing | 16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5 |
882769-5 | 4-Minor | BT882769 | Request Log: wrong filter applied when searching by Response contains or Response does not contain | 16.0.0, 15.1.2, 14.1.2.7, 13.1.3.5 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
722392-2 | 2-Critical | BT722392 | AVR: analytics statistics are displayed even if they are disabled | 14.1.0, 13.1.3.5 |
908065-5 | 3-Major | BT908065 | Logrotation for /var/log/avr blocked by files with .1 suffix | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
902485-1 | 3-Major | BT902485 | Incorrect pool member concurrent connection value | 16.1.0, 16.0.1, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.5 |
838685-1 | 3-Major | BT838685 | DoS report exist in per-widget but not under individual virtual | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.5 |
721408-4 | 3-Major | BT721408 | Possible to create Analytics overview widgets in '[All]' partition | 14.1.0, 13.1.3.5 |
866613-2 | 4-Minor | BT866613 | Missing MaxMemory Attribute | 16.0.0, 15.1.1, 14.1.2.8, 13.1.3.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
833049-3 | 3-Major | BT833049 | Category lookup tool in GUI may not match actual traffic categorization | 16.0.0, 15.1.2, 14.1.4, 13.1.3.5 |
766017-2 | 4-Minor | BT766017 | [APM][LocalDB] Local user database instance name length check inconsistencies★ | 16.1.0, 16.0.1.1, 15.1.2, 14.1.4.2, 13.1.3.5, 12.1.5.3 |
679751-3 | 4-Minor | BT679751 | Authorization header can cause a connection reset | 16.1.0, 15.1.1, 14.1.2.8, 13.1.3.5 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
815877-4 | 3-Major | BT815877 | Information Elements with zero-length value are rejected by the GTP parser | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.5, 12.1.5.2, 11.6.5.3 |
845461-1 | 5-Cosmetic | BT845461 | MRF DIAMETER: additional details to log event to assist debugging | 16.0.0, 13.1.3.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
703165-5 | 3-Major | BT703165 | shared memory leakage | 15.0.0, 14.1.2.8, 13.1.3.5 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
783289-3 | 2-Critical | BT783289 | PEM actions not applied in VE bigTCP. | 15.1.0, 14.1.3.1, 13.1.3.5 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
943889 | 2-Critical | BT943889 | Reopening the publisher after a failed publishing attempt | 14.1.4, 13.1.3.5 |
876581-5 | 3-Major | BT876581 | JavaScript engine file is empty if the original HTML page cached for too long | 16.1.0, 16.0.1, 15.1.1, 14.1.2.8, 13.1.3.5 |
940401-4 | 5-Cosmetic | BT940401 | Mobile Security 'Rooting/Jailbreak Detection' now reads 'Rooting Detection' | 16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
913441 | 2-Critical | BT913441 | Tmm cores while doing Hitless Upgrade while there are active flows | 13.1.3.5, 12.1.5.3 |
745733-1 | 3-Major | BT745733 | TMSH command "tmsh show ltm urlcat-query" not performing cloud lookup | 15.0.0, 14.1.0.2, 13.1.3.5 |
689614-1 | 3-Major | BT689614 | If DNS is not configured and management proxy is setup correctly, Webroot database fails to download | 14.0.0, 13.1.3.5 |
Device Management Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
767613-3 | 3-Major | BT767613 | Restjavad can keep partially downloaded files open indefinitely | 15.1.0, 14.1.3.1, 13.1.3.5 |
Cumulative fixes from BIG-IP v13.1.3.4 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
900757-5 | CVE-2020-5902 | K52145254, BT900757 | TMUI RCE vulnerability CVE-2020-5902 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4 |
895525-5 | CVE-2020-5902 | K52145254, BT895525 | TMUI RCE vulnerability CVE-2020-5902 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
909237-3 | CVE-2020-8617 | K05544642 | CVE-2020-8617: BIND Vulnerability | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
909233-3 | CVE-2020-8616 | K97810133, BT909233 | DNS Hardening | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
905905-4 | CVE-2020-5904 | K31301245, BT905905 | TMUI CSRF vulnerability CVE-2020-5904 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2 |
895993-5 | CVE-2020-5902 | K52145254, BT895993 | TMUI RCE vulnerability CVE-2020-5902 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
895981-5 | CVE-2020-5902 | K52145254, BT895981 | TMUI RCE vulnerability CVE-2020-5902 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2 |
895881-4 | CVE-2020-5903 | K43638305, BT895881 | BIG-IP TMUI XSS vulnerability CVE-2020-5903 | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.2 |
883717-4 | CVE-2020-5914 | K37466356, BT883717 | BD crash on specific server cookie scenario | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
852445-5 | CVE-2019-6477 | K15840535, BT852445 | Big-IP : CVE-2019-6477 BIND Vulnerability | 16.0.0, 14.1.2.5, 13.1.3.4, 12.1.5.1, 11.6.5.2 |
841577-6 | CVE-2020-5922 | K20606443, BT841577 | iControl REST hardening | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.4, 12.1.5.2 |
838677-5 | CVE-2019-10744 | K47105354, BT838677 | lodash library vulnerability CVE-2019-10744 | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
837773-4 | CVE-2020-5912 | K12936322, BT837773 | Restjavad Storage and Configuration Hardening | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3, 11.6.5.2 |
830401-5 | CVE-2020-5877 | K54200228, BT830401 | TMM may crash while processing TCP traffic with iRules | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
819197-6 | CVE-2019-13135 | K20336394, BT819197 | BIGIP: CVE-2019-13135 ImageMagick vulnerability | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
819189-5 | CVE-2019-13136 | K03512441, BT819189 | BIGIP: CVE-2019-13136 ImageMagick vulnerability | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
818709-4 | CVE-2020-5858 | K36814487, BT818709 | TMSH does not follow current best practices | 15.1.0, 15.0.1.4, 14.1.2.3, 13.1.3.4, 12.1.5.1, 11.6.5.2 |
778077-1 | CVE-2019-6680 | K53183580, BT778077 | Virtual to virtual chain can cause TMM to crash | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.4, 12.1.5.1, 11.6.5.1 |
767373-3 | CVE-2019-8331 | K24383845, BT767373 | CVE-2019-8331: Bootstrap Vulnerability | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.1 |
750292-4 | CVE-2019-6592 | K54167061, BT750292 | TMM may crash when processing TLS traffic | 15.0.0, 14.1.0.2, 13.1.3.4, 12.1.5.3 |
886085-1 | CVE-2020-5925 | K45421311, BT886085 | BIG-IP TMM vulnerability CVE-2020-5925 | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
872673-4 | CVE-2020-5918 | K26464312, BT872673 | TMM can crash when processing SCTP traffic | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
868349-5 | CVE-2020-5935 | K62830532, BT868349 | TMM may crash while processing iRules with MQTT commands | 16.0.0, 15.1.1, 14.1.2.5, 13.1.3.4 |
860477-6 | CVE-2020-5906 | K82518062 | SCP hardening | 13.1.3.4, 12.1.5.2 |
859089-3 | CVE-2020-5907 | K00091341, BT859089 | TMSH allows SFTP utility access | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3, 11.6.5.2 |
858025-5 | CVE-2021-22984 | K33440533, BT858025 | BIG-IP ASM Bot Defense open redirection vulnerability CVE-2021-22984 | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
832885-5 | CVE-2020-5923 | K05975972, BT832885 | Self-IP hardening | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
829121-5 | CVE-2020-5886 | K65720640, BT829121 | State mirroring default does not require TLS | 16.0.0, 15.1.0.2, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
829117-5 | CVE-2020-5885 | K17663061, BT829117 | State mirroring default does not require TLS | 16.0.0, 15.1.0.2, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
811789-4 | CVE-2020-5915 | K57214921, BT811789 | Device trust UI hardening | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3, 11.6.5.2 |
789921-4 | CVE-2020-5881 | K03386032, BT789921 | TMM may restart while processing VLAN traffic | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
761112-5 | CVE-2019-6683 | K76328112, BT761112 | TMM may consume excessive resources when processing FastL4 traffic | 15.1.0, 15.0.1.4, 14.1.2.3, 14.0.1.1, 13.1.3.4, 12.1.5.1, 11.6.5.2 |
756458-1 | CVE-2018-18559 | K28241423, BT756458 | Linux kernel vulnerability: CVE-2018-18559 | 15.1.0, 15.0.1.4, 14.1.2.1, 13.1.3.4 |
745103-4 | CVE-2018-7159 | K27228191, BT745103 | NodeJS Vulnerability: CVE-2018-7159 | 15.1.0, 15.0.1.3, 14.1.2.1, 13.1.3.4 |
715969-1 | CVE-2017-5703 | K19855851, BT715969 | CVE-2017-5703: Unsafe Opcodes exposed in Intel SPI based products | 14.1.0, 13.1.3.4 |
823893-4 | CVE-2020-5890 | K03318649, BT823893 | Qkview may fail to completely sanitize LDAP bind credentials | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
746091-3 | CVE-2019-19151 | K21711352, BT746091 | TMSH Vulnerability: CVE-2019-19151 | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3 |
717276-5 | CVE-2020-5930 | K20622530, BT717276 | TMM Route Metrics Hardening | 16.0.0, 15.1.0.5, 14.1.2.8, 13.1.3.4, 12.1.5.3, 11.6.5.3 |
759536-4 | CVE-2019-8912 | K31739796, BT759536 | Linux kernel vulnerability: CVE-2019-8912 | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.4 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
819397-3 | 1-Blocking | K50375550, BT819397 | TMM does not enforce RFC compliance when processing HTTP traffic | 15.0.1.1, 14.1.2.3, 13.1.3.4, 12.1.5.1 |
858229-2 | 3-Major | K22493037, BT858229 | XML with sensitive data gets to the ICAP server | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
691499-1 | 3-Major | BT691499 | GTP::ie primitives in iRule to be certified | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.4 |
617929-4 | 3-Major | BT617929 | Support non-default route domains | 15.1.0, 15.0.1.3, 14.1.2.8, 13.1.3.4 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
747099-1 | 1-Blocking | BT747099 | AWS Cloud VE instance cannot connect to the metadata server to obtain licensing details. | 15.0.0, 13.1.3.4 |
841333-3 | 2-Critical | BT841333 | TMM may crash when tunnel used after returning from offline | 16.0.0, 15.1.0.2, 14.1.2.8, 13.1.3.4, 12.1.5.3 |
792285-3 | 2-Critical | BT792285 | TMM crashes if the queuing message to all HSL pool members fails | 15.1.0, 14.1.2.5, 13.1.3.4 |
780817 | 2-Critical | BT780817 | TMM can crash on certain vCMP hosts after modifications to VLANs and guests. | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.4, 12.1.5.3 |
767013-4 | 2-Critical | BT767013 | Reboot when HSB is in a bad state observed through HSB sending continuous pause frames to the Broadcom Switch | 15.1.0, 14.1.4.4, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
762205-1 | 2-Critical | BT762205 | IKEv2 rekey fails to recognize VENDOR_ID payload when it appears | 15.1.0, 15.0.1.4, 14.1.2.3, 13.1.3.4 |
882557-5 | 3-Major | BT882557 | TMM restart loop if virtio platform specifies RX or TX queue sizes that are too large (4096 or higher) | 16.0.0, 15.1.0.4, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
866925-1 | 3-Major | BT866925 | The TMM pages used and available can be viewed in the F5 system stats MIB | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 |
865225-2 | 3-Major | BT865225 | 100G modules may not work properly in i15000 and i15800 platforms | 16.1.0, 15.1.0.2, 14.1.5.1, 13.1.3.4 |
842125-2 | 3-Major | BT842125 | Unable to reconnect outgoing SCTP connections that have previously aborted | 16.0.0, 15.1.0.5, 14.1.2.5, 13.1.3.4 |
812981-2 | 3-Major | BT812981 | MCPD: memory leak on standby BIG-IP device | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4, 12.1.5.1 |
807005-3 | 3-Major | BT807005 | Save-on-auto-sync is not working as expected with large configuration objects | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.4, 12.1.5.3, 11.6.5.2 |
804477-2 | 3-Major | BT804477 | Add HSB register logging when parts of the device becomes unresponsive | 15.1.0, 14.1.4.3, 13.1.3.4 |
800185-2 | 3-Major | BT800185 | Saving a large encrypted UCS archive may fail and might trigger failover | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3 |
762073-1 | 3-Major | BT762073 | Continuous TMM restarts when HSB drops off the PCI bus | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
760439-2 | 3-Major | BT760439 | After installing a UCS that was taken in forced-offline state, the unit may release forced-offline status | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.4, 12.1.5.3 |
753860-1 | 3-Major | BT753860 | Virtual server config changes causing incorrect route injection. | 15.1.0, 14.1.2.7, 13.1.3.4 |
749153-1 | 3-Major | BT749153 | Cannot create LTM policy from GUI using iControl | 13.1.3.4, 12.1.4.1 |
742628-5 | 3-Major | BT742628 | A tmsh session initiation adds increased control plane pressure | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.4, 14.1.2.6, 13.1.3.4, 12.1.5.3 |
739872-2 | 3-Major | BT739872 | The 'load sys config verify' command can cause HA Group scores to be updated, possibly triggering a failover | 14.1.0, 13.1.3.4, 12.1.5.3 |
738943-5 | 3-Major | BT738943 | imish command hangs when ospfd is enabled | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.4, 12.1.5.3 |
738881-2 | 3-Major | BT738881 | Qkview does not collect any data under certain conditions that cause a timeout | 15.0.0, 14.1.5, 13.1.3.4 |
734846-3 | 3-Major | BT734846 | Redirection to logon summary page does not occur after session timeout | 14.1.0, 13.1.3.4 |
701529-1 | 3-Major | BT701529 | Configuration may not load or not accept vlan or tunnel names as "default" or "all" | 15.1.0, 14.1.2.7, 13.1.3.4 |
688399-4 | 3-Major | BT688399 | HSB failure results in continuous TMM restarts | 15.1.0, 15.0.1.4, 14.1.2.7, 13.1.3.4, 12.1.5.3 |
648621-5 | 3-Major | BT648621 | SCTP: Multihome connections may not expire | 15.1.0, 15.0.1.4, 14.1.2.1, 13.1.3.4, 12.1.5.2, 11.6.5.3 |
641450-5 | 3-Major | K30053855, BT641450 | A transaction that deletes and recreates a virtual may result in an invalid configuration | 15.0.0, 14.1.2.5, 13.1.3.4, 12.1.5.1 |
625901-2 | 3-Major | BT625901 | SNAT pools allow members in different partitions to be assigned, but this causes a load failure | 14.0.0, 13.1.3.4, 12.1.5.1 |
748940-1 | 4-Minor | BT748940 | iControl REST cert creation not working for non-Common folder | 15.0.0, 13.1.3.4 |
743815-3 | 4-Minor | BT743815 | vCMP guest observes connflow reset when a CMP state change occurs. | 15.0.0, 14.1.2.7, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
726317-4 | 4-Minor | BT726317 | Improved debugging output for mcpd | 15.0.0, 14.1.0.6, 13.1.3.4, 12.1.5 |
722230-5 | 4-Minor | BT722230 | Cannot delete FQDN template node if another FQDN node resolves to same IP address | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.3.1, 13.1.3.4, 12.1.5.2 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
816273-4 | 1-Blocking | BT816273 | L7 Policies may execute CONTAINS operands incorrectly. | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.4 |
715032-5 | 1-Blocking | K73302459, BT715032 | iRulesLX Hardening | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.3 |
853329 | 2-Critical | BT853329 | HTTP explicit proxy can crash TMM when used with classification profile | 15.0.1.3, 14.1.2.5, 13.1.3.4, 11.6.5.2 |
841469-3 | 2-Critical | BT841469 | Application traffic may fail after an internal interface failure on a VIPRION system. | 16.0.0, 15.1.2.1, 14.1.5, 13.1.3.4 |
831325-3 | 2-Critical | K10701310, BT831325 | HTTP PSM detects more issues with Transfer-Encoding headers | 15.1.0, 15.0.1.1, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
826601-3 | 2-Critical | BT826601 | Prevent receive window shrinkage for looped flows that use a SYN cookie | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.4, 12.1.5.1, 11.6.5.2 |
813561-1 | 2-Critical | BT813561 | MCPD crashes when assigning an iRule that uses a proc | 15.1.0, 15.0.1.3, 14.1.2.8, 13.1.3.4 |
812525-5 | 2-Critical | K27551003, BT812525 | The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it | 16.0.0, 15.1.2.1, 15.0.1.4, 14.1.4, 13.1.3.4 |
757578-4 | 2-Critical | BT757578 | RAM cache is not compatible with verify-accept | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.4, 12.1.5.2 |
696908-1 | 2-Critical | BT696908 | Updating iRule causes TMM to crash | 14.0.0, 13.1.3.4 |
690291-1 | 2-Critical | BT690291 | tmm crash | 14.0.0, 13.1.3.4 |
858301-4 | 3-Major | K27551003, BT858301 | The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it | 16.0.0, 15.1.2.1, 15.0.1.4, 14.1.4, 13.1.3.4, 12.1.5.2 |
858297-4 | 3-Major | K27551003, BT858297 | The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it | 16.0.0, 15.1.2.1, 15.0.1.4, 14.1.4, 13.1.3.4, 12.1.5.2 |
858289-4 | 3-Major | K27551003, BT858289 | The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it | 16.0.0, 15.1.2.1, 15.0.1.4, 14.1.4, 13.1.3.4 |
858285-4 | 3-Major | K27551003, BT858285 | The BIG-IP system may not interpret an HTTP request the same way the target web server interprets it | 16.0.0, 15.1.2.1, 15.0.1.4, 14.1.4, 13.1.3.4 |
796993-3 | 3-Major | BT796993 | Ephemeral FQDN pool members status changes are not logged in /var/log/ltm logs | 15.1.0, 14.1.3.1, 13.1.3.4, 12.1.5.3 |
788753-1 | 3-Major | BT788753 | GATEWAY_ICMP monitor marks node down with wrong error code | 16.0.0, 15.1.0.5, 14.1.2.8, 13.1.3.4 |
778517-2 | 3-Major | K91052217, BT778517 | Large number of in-TMM monitors results in delayed processing | 15.1.0, 14.1.2.7, 13.1.3.4 |
776229-4 | 3-Major | BT776229 | iRule 'pool' command no longer accepts pool members with ports that have a value of zero | 15.1.0, 14.1.3.1, 13.1.3.4 |
761185-4 | 3-Major | K50375550, BT761185 | Specifically crafted requests may lead the BIG-IP system to pass malformed HTTP traffic | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.4, 12.1.5.1 |
760679 | 3-Major | BT760679 | Memory corruption when using C3D on certain platforms | 13.1.3.4 |
759480-2 | 3-Major | BT759480 | HTTP::respond or HTTP::redirect in LB_FAILED may result in TMM crash | 15.0.0, 14.1.3.1, 13.1.3.4, 12.1.5 |
758872-2 | 3-Major | BT758872 | TMM memory leak | 15.0.0, 14.1.2.3, 13.1.3.4, 12.1.5 |
756494-1 | 3-Major | BT756494 | For in-tmm monitoring: multiple instances of the same agent are running on the Standby device | 15.0.0, 14.1.2.7, 13.1.3.4 |
753805-1 | 3-Major | BT753805 | BIG-IP system failed to advertise virtual address even after the virtual address was in Available state. | 15.0.0, 14.1.3.1, 13.1.3.4, 12.1.5.3 |
716167-1 | 3-Major | BT716167 | The value of the sys db variable vlan.backplane.mtu may be out-of-sync with the value of the MTU of the kernel interface tmm_bp | 15.0.0, 14.1.0.2, 13.1.3.4 |
686059-2 | 3-Major | BT686059 | FDB entries for existing VLANs may be flushed when creating a new VLAN. | 15.1.0, 14.1.2.7, 13.1.3.4, 12.1.5.3 |
751586-5 | 4-Minor | BT751586 | Http2 virtual does not honour translate-address disabled | 16.0.0, 15.1.4, 14.1.2.1, 13.1.3.4, 12.1.4.1 |
747585-2 | 4-Minor | BT747585 | TCP Analytics supports ANY protocol number | 15.1.0, 14.1.2.1, 13.1.3.4, 12.1.5 |
594064-5 | 4-Minor | K57004151, BT594064 | tcpdump with :p misses first few packets on forwarding (UDP, FastL4) flows. | 14.1.0, 13.1.3.4, 12.1.5.2, 11.6.5.3 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
807177-1 | 2-Critical | BT807177 | HTTPS monitoring is not caching SSL sessions correctly | 15.1.0, 14.1.2.5, 13.1.3.4 |
802961-1 | 3-Major | BT802961 | The 'any-available' prober selection is not as random as in earlier versions | 15.1.0, 14.1.2.5, 13.1.3.4 |
778365-1 | 3-Major | BT778365 | dns-dot & dns-rev metrics collection set RTT values even though LDNS has no DNS service | 15.1.0, 14.1.2.7, 13.1.3.4 |
774481-3 | 3-Major | BT774481 | DNS Virtual Server creation problem with Dependency List | 15.1.0, 14.1.2.7, 13.1.3.4 |
756470-3 | 3-Major | BT756470 | Additional logging added to detect when monitoring operations in the configuration exceeds capabilities. | 15.0.0, 14.1.4.5, 13.1.3.4 |
746348-1 | 3-Major | BT746348 | On rare occasions, gtmd fails to process probe responses originating from the same system. | 16.0.0, 15.1.2, 14.1.2.7, 13.1.3.4, 12.1.5.2 |
704198-3 | 3-Major | K29403988, BT704198 | Replace-all-with can leave orphaned monitor_rule, monitor_rule_instance, and monitor_instance | 15.1.0, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
744280-1 | 4-Minor | BT744280 | Enabling or disabling a Distributed Application results in a small memory leak | 15.1.0, 14.1.2.5, 14.0.0.5, 13.1.3.4 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
803813-3 | 2-Critical | BT803813 | TMM may experience high latency when processing WebSocket traffic | 15.1.0, 14.1.2.7, 13.1.3.4 |
754109-3 | 2-Critical | BT754109 | ASM/Bot-Defense/DoSL7 content-security-policy header modification violates Content Security Policy directive | 15.0.0, 14.1.2.3, 13.1.3.4 |
854177-2 | 3-Major | BT854177 | ASM latency caused by frequent pool IP updates that are unrelated to ASM functionality | 16.0.0, 15.1.0.5, 14.1.2.5, 13.1.3.4, 12.1.5.1 |
850673-4 | 3-Major | BT850673 | BD sends bad ACKs to the bd_agent for configuration | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4, 12.1.5.1 |
846493 | 3-Major | BT846493 | ASM CAPTCHA is not working the first time when a request contains sensitive parameters | 13.1.3.4 |
783505 | 3-Major | BT783505 | ASU is very slow on device with hundreds of policies due to table checksums | 13.1.3.4, 12.1.5.1 |
697269-1 | 3-Major | BT697269 | Request logging is briefly suspended after policy creation | 14.0.0, 13.1.3.4 |
689987-3 | 3-Major | BT689987 | Requests are not logged on new virtual servers after UCS load while ASM is running | 14.0.0, 13.1.3.4 |
681010-2 | 3-Major | K33572148, BT681010 | 'Referer' is not masked when 'Query String' contains sensitive parameter | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4, 12.1.5.2, 11.6.5.2 |
673522-1 | 3-Major | BT673522 | RST when using Bot Defense profile and surfing to a long URL on related domain | 14.0.0, 13.1.3.4 |
629628-1 | 3-Major | BT629628 | Request Events Missing Due to Policy Builder Restart | 14.1.0, 13.1.3.4 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
838709-2 | 2-Critical | BT838709 | Enabling DoS stats also enables page-load-time | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 |
828937-4 | 2-Critical | K45725467, BT828937 | Some systems can experience periodic high IO wait due to AVR data aggregation | 16.0.0, 15.1.0.5, 14.1.2.5, 13.1.3.4 |
870957-2 | 3-Major | "Security ›› Reporting : ASM Resources : CPU Utilization" shows TMM has 100% CPU usage | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 | |
863161-5 | 3-Major | BT863161 | Scheduled reports are sent via TLS even if configured as non encrypted | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 |
833113-1 | 3-Major | BT833113 | Avrd core when sending large messages via https | 16.0.0, 15.1.4, 15.0.1.3, 14.1.4.3, 13.1.3.4 |
830073-5 | 3-Major | BT830073 | AVRD may core when restarting due to data collection device connection timeout | 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 |
700035-5 | 3-Major | BT700035 | /var/log/avr/monpd.disk.provision not rotate | 14.0.0, 13.1.3.4 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
885241 | 2-Critical | BT885241 | TMM leaks memory when the 'ACCESS::session remove' iRule command is called in an event other than an ACCESS event. | 13.1.3.4 |
871761-2 | 2-Critical | BT871761 | Unexpected FIN from APM virtual server during Access Policy evaluation if XML profile is configured for VS | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.5, 13.1.3.4 |
747192-2 | 2-Critical | BT747192 | Small memory leak while creating Access Policy items | 14.1.0, 13.1.3.4, 12.1.4.1 |
660913-4 | 2-Critical | BT660913 | For ActiveSync client type, browscap info provided is incorrect.★ | 15.0.0, 14.1.4.3, 13.1.3.4, 12.1.4.1 |
850277-5 | 3-Major | BT850277 | Memory leak when using OAuth | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.4, 13.1.3.4 |
803825 | 3-Major | BT803825 | WebSSO does not support large NTLM target info length | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.4.4, 13.1.3.4 |
744407-5 | 3-Major | BT744407 | While the client has been closed, iRule function should not try to check on a closed session | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.4.4, 13.1.3.4 |
WebAccelerator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
833213-5 | 3-Major | BT833213 | Conditional requests are served incorrectly with AAM policy in webacceleration profile | 15.1.3, 15.0.1.3, 14.1.2.3, 13.1.3.4 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
814097-4 | 2-Critical | BT814097 | Using Generic Message router to convert a SIP message from TCP to UDP fails to fire SERVER_CONNECTED iRule event. | 15.1.0, 14.1.2.7, 13.1.3.4, 11.6.5.2 |
811105-3 | 2-Critical | BT811105 | MRF SIP-ALG drops SIP 183 and 200 OK messages | 15.1.0, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
766405-3 | 2-Critical | BT766405 | MRF SIP ALG with SNAT: Fix for potential crash on next-active device | 15.1.0, 14.1.0.6, 13.1.3.4 |
745397-3 | 2-Critical | BT745397 | Virtual server configured with FIX profile can leak memory. | 15.0.0, 14.1.0, 13.1.3.4 |
882273-1 | 3-Major | BT882273 | MRF Diameter: memory leak during server down and reconnect attempt which leads to tmm crash and memory usage grow | 14.1.2.5, 13.1.3.4 |
866021-4 | 3-Major | BT866021 | Diameter Mirror connection lost on the standby due to "process ingress error" | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
842625-1 | 3-Major | BT842625 | SIP message routing remembers a 'no connection' failure state forever | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.7, 13.1.3.4 |
824149-1 | 3-Major | BT824149 | SIP ALG virtual with source-nat-policy cores if traffic does not match the source-nat-policy or matches the source-nat-policy which does not have source-translation configured | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
815529-4 | 3-Major | BT815529 | MRF outbound messages are dropped in per-peer mode | 15.1.0, 14.1.2.7, 13.1.3.4 |
811033-3 | 3-Major | BT811033 | MRF: BiDirectional pesistence does not work in reverse direction if different transport protocols are used | 15.1.0, 14.1.2.5, 13.1.3.4 |
804313-4 | 3-Major | BT804313 | MRF SIP, Diameter, Generic MSG, high availability (HA) - mirrored-message-sweeper-interval not loaded. | 15.1.0, 15.0.1.2, 14.1.2.1, 13.1.3.4 |
803809-1 | 3-Major | BT803809 | SIP messages fail to forward in MRF SIP when preserve-strict source port is enabled. | 16.0.0, 15.1.0.2, 14.1.2.7, 13.1.3.4 |
782353-8 | 3-Major | BT782353 | SIP MRF via header shows TCP Transport when TLS is enabled | 15.1.0, 14.1.2.7, 13.1.3.4 |
754658-1 | 3-Major | BT754658 | Improved matching of response messages uses end-to-end ID | 15.0.0, 14.1.2.7, 13.1.3.4 |
754617-1 | 3-Major | BT754617 | iRule 'DIAMETER::avp read' command does not work with 'source' option | 14.1.2.7, 13.1.3.4 |
746731-3 | 3-Major | BT746731 | BIG-IP system sends Firmware-Revision AVP in CER with Mandatory bit set | 15.0.0, 14.1.2.7, 13.1.3.4 |
744275-3 | 3-Major | BT744275 | BIG-IP system sends Product-Name AVP in CER with Mandatory bit set | 15.0.0, 14.1.0.2, 13.1.3.4 |
727288-3 | 3-Major | BT727288 | Diameter MRF CER/DWR e2e=0, h2h=0 does not comply with RFC | 15.0.0, 14.1.0, 13.1.3.4 |
696348-2 | 3-Major | BT696348 | "GTP::ie insert" and "GTP::ie append" do not work without "-message" option | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.4 |
676709-3 | 3-Major | K37604585, BT676709 | Diameter virtual server has different behavior of connection-prime when persistence is on/off | 14.0.0, 13.1.3.4, 11.6.5.2 |
836357-1 | 4-Minor | BT836357 | SIP MBLB incorrectly initiates new flow from virtual IP to client when existing flow is in FIN-wait2 | 16.0.0, 15.1.0.2, 15.0.1.4, 14.1.2.5, 13.1.3.4, 12.1.5.2 |
793013 | 4-Minor | BT793013 | MRF DIAMETER: Implement sweeper for pending request messages queue | 13.1.3.4 |
788513-4 | 4-Minor | BT788513 | Using RADIUS::avp replace with variable produces RADIUS::avp replace USER-NAME $custom_name warning in log | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.7, 13.1.3.4, 12.1.5.2 |
786981-1 | 4-Minor | BT786981 | Pending GTP iRule operation maybe aborted when connection is expired | 15.1.0, 14.1.2.7, 13.1.3.4 |
753790 | 4-Minor | BT753790 | Allow 'DIAMETER::persist reset' command in EGRESS events | 13.1.3.4 |
711641-1 | 4-Minor | BT711641 | MRF DIAMETER: Add log events to log when stale messages are removed from pending request queue | 14.1.0, 13.1.3.4 |
793005-4 | 5-Cosmetic | BT793005 | 'Current Sessions' statistic of MRF/Diameter pool may be incorrect | 16.0.0, 15.1.0.5, 14.1.2.7, 13.1.3.4 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
852289-6 | 3-Major | K23278332, BT852289 | DNS over TCP packet is not rate-limited accurately by DoS device sweep/flood vector | 16.0.0, 15.1.1, 14.1.2.5, 13.1.3.4 |
751116-3 | 3-Major | BT751116 | DNS or Network protocol DoS attacks reported as mitigating when configured as monitoring | 15.0.0, 14.1.4.2, 13.1.3.4 |
Device Management Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
839597-2 | 3-Major | BT839597 | Restjavad fails to start if provision.extramb has a large value | 16.0.0, 15.1.0.5, 15.0.1.4, 14.1.2.5, 13.1.3.4 |
Cumulative fixes from BIG-IP v13.1.3.3 that are included in this release
Functional Change Fixes
None
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
803645-1 | 3-Major | BT803645 | GTMD daemon crashes | 15.1.0, 14.1.2.7, 13.1.3.3 |
Cumulative fixes from BIG-IP v13.1.3.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
818429-2 | CVE-2020-5857 | K70275209, BT818429 | TMM may crash while processing HTTP traffic | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2, 12.1.5.1 |
808301-1 | CVE-2019-6678 | K04897373, BT808301 | TMM may crash while processing IP traffic | 15.1.0, 15.0.1.1, 14.1.2.3, 14.0.1.1, 13.1.3.2 |
805837-4 | CVE-2019-6657 | K22441651, BT805837 | REST does not follow current design best practices | 15.1.0, 15.0.1.1, 14.1.2.5, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
795437-2 | CVE-2019-6677 | K06747393, BT795437 | Improve handling of TCP traffic for iRules | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1 |
795197-3 | CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 | K26618426, BT795197 | Linux Kernel Vulnerabilities: CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
781377-1 | CVE-2019-6681 | K93417064, BT781377 | tmrouted may crash while processing Multicast Forwarding Cache messages | 15.1.0, 15.0.1.4, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1 |
780601-4 | CVE-2020-5873 | K03585731, BT780601 | SCP file transfer hardening | 15.1.0, 15.0.1.1, 14.1.2.5, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
769589-4 | CVE-2019-6974 | K11186236, BT769589 | CVE-2019-6974: Linux Kernel Vulnerability | 15.1.0, 14.1.2.5, 13.1.3.2 |
762453 | CVE-2020-5872 | K63558580, BT762453 | Hardware cryptography acceleration may fail | 15.0.0, 14.1.2.5, 14.0.1.1, 13.1.3.2, 12.1.5 |
757357 | CVE-2019-6676 | K92002212, BT757357 | TMM may crash while processing traffic | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
636400-1 | CVE-2019-6665 | K26462555, BT636400 | CPB (BIG-IP->BIGIQ log node) Hardening | 15.1.0.2, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
810537-3 | CVE-2020-5883 | K12234501, BT810537 | TMM may consume excessive resources while processing iRules | 15.1.0, 15.0.1.1, 14.1.2.5, 14.0.1.1, 13.1.3.2 |
809165-4 | CVE-2020-5854 | K50046200, BT809165 | TMM may crash will processing connector traffic | 15.1.0, 15.0.1.4, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
808525-4 | CVE-2019-6686 | K55812535, BT808525 | TMM may crash while processing Diameter traffic | 15.1.0, 15.0.1.4, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
795797-4 | CVE-2019-6658 | K21121741, BT795797 | AFM WebUI Hardening | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2, 12.1.5.1 |
788773-4 | CVE-2019-9515 | K50233772, BT788773 | HTTP/2 Vulnerability: CVE-2019-9515 | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
788769-4 | CVE-2019-9514 | K01988340, BT788769 | HTTP/2 Vulnerability: CVE-2019-9514 | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
782529-4 | CVE-2019-6685 | K30215839, BT782529 | iRules does not follow current design best practices | 15.1.0, 15.0.1.3, 14.1.2.3, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
781449-4 | CVE-2019-6672 | K14703097, BT781449 | Increase efficiency of sPVA DoS protection on wildcard virtual servers | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
777737-2 | CVE-2019-6671 | K39225055, BT777737 | TMM may consume excessive resources when processing IP traffic | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
773673-4 | CVE-2019-9512 | K98053339, BT773673 | HTTP/2 Vulnerability: CVE-2019-9512 | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
768981-4 | CVE-2019-6670 | K05765031, BT768981 | VCMP Hypervisor Hardening | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
761144-6 | CVE-2019-6684 | K95117754, BT761144 | Broadcast frames may be dropped | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
761014-4 | CVE-2019-6669 | K11447758, BT761014 | TMM may crash while processing local traffic | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1 |
758018-3 | CVE-2019-6661 | K61705126, BT758018 | APD/APMD may consume excessive resources | 15.1.0, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5, 11.6.5.1 |
725551-4 | CVE-2019-6682 | K40452417, BT725551 | ASM may consume excessive resources | 15.1.0, 15.0.1.4, 14.1.2.3, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
636453-9 | CVE-2016-10009 | K31440025 | OpenSSH vulnerability CVE-2016-10009 | 14.1.0, 13.1.3.2 |
789893-4 | CVE-2019-6679 | K54336216, BT789893 | SCP file transfer hardening | 15.1.0, 15.0.1.1, 14.1.2.3, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
779177-4 | CVE-2019-19150 | K37890841, BT779177 | Apmd logs "client-session-id" when access-policy debug log level is enabled | 15.1.0, 15.0.1.3, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
749324-2 | CVE-2012-6708 | K62532311, BT749324 | jQuery Vulnerability: CVE-2012-6708 | 15.0.0, 14.1.2.3, 13.1.3.2, 12.1.5.2 |
738236-2 | CVE-2019-6688 | K25607522, BT738236 | UCS does not follow current best practices | 15.1.0, 15.0.1.3, 14.1.2.3, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
724556-2 | 2-Critical | BT724556 | icrd_child spawns more than maximum allowed times (zombie processes) | 15.0.0, 14.1.2.7, 13.1.3.2, 12.1.5.3 |
769193-1 | 3-Major | BT769193 | Added support for faster congestion window increase in slow-start for stretch ACKs | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2, 12.1.5.1 |
759135-5 | 3-Major | BT759135 | AVR report limits are locked at 1000 transactions | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
788269-1 | 4-Minor | BT788269 | Adding toggle to disable AVR widgets on device-groups | 15.1.0, 15.0.1.3, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
725950 | 1-Blocking | BT725950 | Regcomp() leaks memory if passed an invalid regex. | 13.1.3.2 |
831549 | 2-Critical | BT831549 | Marketing name does not display properly for BIG-IP i10010 (C127) | 14.1.4.4, 13.1.3.2 |
765533-4 | 2-Critical | K58243048, BT765533 | Sensitive information logged when DEBUG logging enabled | 15.0.0, 14.1.2.1, 13.1.3.2, 12.1.5.1, 11.6.5.2 |
749388 | 2-Critical | BT749388 | 'table delete' iRule command can cause TMM to crash | 15.0.0, 14.1.2.5, 13.1.3.2, 12.1.5.2 |
747203-4 | 2-Critical | BT747203 | Fragile NATT IKEv2 interface mode tunnel suffers RST after flow-not-found after forwarding | 15.1.0, 15.0.1.3, 13.1.3.2 |
686996-1 | 2-Critical | BT686996 | TMM core under heavy load with PEM | 14.0.0, 13.1.3.2 |
809205-3 | 3-Major | CVE-2019-3855: libssh2 Vulnerability | 16.0.1.2, 15.1.3, 15.0.1.1, 14.1.2.3, 13.1.3.2, 12.1.5.1 | |
794501-4 | 3-Major | BT794501 | Duplicate if_indexes and OIDs between interfaces and tunnels | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2, 12.1.5.3 |
793121-1 | 3-Major | BT793121 | Enabling sys httpd redirect-http-to-https prevents vCMP host-to-guest communication | 16.0.0, 15.1.0.2, 15.0.1.3, 14.1.2.7, 13.1.3.2 |
788557 | 3-Major | BT788557 | BGP and BFD sessions are reset in GRST timeout period if bgpd daemon is restarted prior | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2, 11.6.5.2 |
788301-3 | 3-Major | K58243048, BT788301 | SNMPv3 Hardening | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5, 11.6.5.1 |
777261-2 | 3-Major | BT777261 | When SNMP cannot locate a file it logs messages repeatedly | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5, 11.6.5.1 |
764873-4 | 3-Major | BT764873 | An accelerated flow may transmit packets to an unavailable pool member. | 15.1.0, 15.0.1.3, 14.1.4.2, 13.1.3.2 |
761993-4 | 3-Major | BT761993 | The nsm process may crash if it detects a nexthop mismatch | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
759735-1 | 3-Major | BT759735 | OSPF ASE route calculation for new external-LSA delayed | 15.1.0, 14.1.2.5, 13.1.3.2 |
758781-1 | 3-Major | BT758781 | iControl SOAP get_certificate_list commands take a long time to complete when there are a large number of certificates | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
758527-4 | 3-Major | K39604784, BT758527 | BIG-IP system forwards BPDUs with 802.1Q header when in STP pass-through mode | 15.1.0, 15.0.1.3, 14.1.2.3, 14.0.0.5, 13.1.3.2, 12.1.5, 11.6.5.1 |
758119-4 | 3-Major | K58243048, BT758119 | qkview may contain sensitive information | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5, 11.6.5.1 |
747592-2 | 3-Major | PHP vulnerability CVE-2018-17082 | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5, 11.6.5.1 | |
745825-3 | 3-Major | BT745825 | The "audit_forwarder is disabled as the configuration is incomplete" message can be confusing if logged when the configuration is loading | 15.0.0, 14.1.0.2, 13.1.3.2 |
741902-3 | 3-Major | BT741902 | sod does not validate message length vs. received packet length | 14.1.0, 13.1.3.2, 12.1.5.2, 11.6.5.2 |
740413-3 | 3-Major | BT740413 | Sod not logging Failover Condition messages | 14.1.0, 13.1.3.2 |
738445-2 | 3-Major | BT738445 | IKEv1 handles INVALID-SPI incorrectly in parsing SPI and in phase 2 lookup | 14.1.0, 14.0.1.1, 13.1.3.2, 12.1.5 |
724109-4 | 3-Major | BT724109 | Manual config-sync fails after pool with FQDN pool members is deleted | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2, 12.1.5.3 |
700712-1 | 3-Major | BT700712 | MariaDB binary logging takes up disk space | 14.0.0, 13.1.3.2 |
687115-2 | 3-Major | BT687115 | SNMP performance can be impacted by a long list of allowed-addresses | 14.0.0, 13.1.3.2, 12.1.5.3 |
683135-2 | 3-Major | BT683135 | Hardware syncookies number for virtual server stats is unrealistically high | 15.1.0, 14.1.2.7, 13.1.3.2 |
680917-1 | 3-Major | BT680917 | Invalid monitor rule instance identifier | 15.0.0, 14.1.2.1, 13.1.3.2, 12.1.5.3 |
815425 | 4-Minor | BT815425 | RAID status is shown <undefined> after upgrade from 12.1.3.5 to 13.1.x★ | 13.1.3.2 |
755018-4 | 4-Minor | BT755018 | Egress traffic processing may be stopped on one or more VE trunk interfaces | 15.1.0, 15.0.1.1, 14.1.2.7, 13.1.3.2 |
484683-3 | 4-Minor | BT484683 | Certificate_summary is not created at peer when the chain certificate is synced to high availability (HA) peer. | 15.0.0, 14.1.2.7, 13.1.3.2 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
800305-4 | 2-Critical | BT800305 | VDI::cmp_redirect generates flow with random client port | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
787825-3 | 2-Critical | K58243048, BT787825 | Database monitors debug logs have plaintext password printed in the log file | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
739927-3 | 2-Critical | BT739927 | Bigd crashes after a specific combination of logging operations | 14.1.0, 13.1.3.2, 12.1.4, 11.6.4, 11.5.9 |
693491-1 | 2-Critical | BT693491 | ASM with Web Acceleration Profile can rarely cause TMM to core | 14.0.0, 13.1.3.2 |
813673-1 | 3-Major | BT813673 | The HTTP Explicit proxy does not work correctly with IPv6 clients connecting to IPv4 destinations over CONNECT to IPv4 targets. | 15.1.0, 14.1.5, 13.1.3.2 |
788325-4 | 3-Major | K39794285, BT788325 | Header continuation rule is applied to request/response line | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5.1, 11.6.5.1 |
781753-1 | 3-Major | BT781753 | WebSocket traffic is transmitted with unknown opcodes | 15.1.0, 14.1.2.8, 13.1.3.2 |
773421-2 | 3-Major | BT773421 | Server-side packets dropped with ICMP fragmentation needed when a OneConnect profile is applied | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2, 12.1.5.1 |
770477-3 | 3-Major | BT770477 | SSL aborted when client_hello includes both renegotiation info extension and SCSV | 15.1.0, 14.1.2.5, 13.1.3.2, 12.1.5.3 |
761030-1 | 3-Major | BT761030 | tmsh show net route lookup is not showing for IPv4-mapped IPv6 address route | 15.1.0, 14.1.2.5, 13.1.3.2 |
758992-1 | 3-Major | BT758992 | The BIG-IP may use the traffic-group MAC address rather than a per-VLAN MAC address | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2 |
757827-3 | 3-Major | BT757827 | Allow duplicate FQDN ephemeral create/delete for more reliable FQDN resolution | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3.2 |
755727-3 | 3-Major | BT755727 | Ephemeral pool members not created after DNS flap and address record changes | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3.2, 12.1.5.2 |
749294-2 | 3-Major | BT749294 | TMM cores when query session index is out of boundary | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.3.2, 12.1.5 |
747907-1 | 3-Major | BT747907 | Persistence records leak while the high availability (HA) mirror connection is down | 15.1.0, 14.1.0.6, 13.1.3.2 |
743257-1 | 3-Major | BT743257 | Fix block size insecurity init and assign | 15.0.0, 14.1.2.5, 14.0.0.5, 13.1.3.2 |
742237-2 | 3-Major | BT742237 | CPU spikes appear wider than actual in graphs | 15.0.0, 14.1.2.1, 13.1.3.2, 12.1.5 |
739638-2 | 3-Major | BT739638 | BGP failed to connect with neighbor when pool route is used | 14.1.0, 14.0.1.1, 13.1.3.2, 12.1.4.1 |
726734-1 | 3-Major | BT726734 | DAGv2 port lookup stringent may fail | 15.0.0, 14.1.2.8, 13.1.3.2 |
726176-4 | 3-Major | BT726176 | Platforms using RSS hash reuse source port too rapidly when the FastL4 virtual server is set to source-port preserve | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
716952-2 | 3-Major | BT716952 | With TCP Nagle enabled, SSL filter will hold the HUDCTL_REQUEST_DONE/HUDCTL_RESPONSE_DONE message until the last data packet offload process complete. | 14.1.0, 13.1.3.2 |
704450-3 | 3-Major | BT704450 | bigd may crash when the BIG-IP system is under extremely heavy load, due to running with incomplete configuration | 15.0.0, 14.1.0.2, 13.1.3.2, 12.1.5.2 |
693582-1 | 3-Major | BT693582 | Monitor node log not rotated for certain monitor types | 14.0.0, 13.1.3.2, 12.1.4 |
689361-1 | 3-Major | BT689361 | Configsync can change the status of a monitored pool member | 15.0.0, 14.1.2.1, 13.1.3.2, 12.1.5.2 |
687887-1 | 3-Major | BT687887 | Unexpected result from multiple changes to a monitor-related object in a single transaction | 15.0.0, 14.1.2.3, 13.1.3.2, 12.1.5.3 |
676990-2 | 3-Major | BT676990 | No way to enable SNAT of host traffic | 14.0.0, 13.1.3.2 |
676557-1 | 3-Major | BT676557 | Binary data marshalled to TCL may be converted to UTF8 | 14.0.0, 13.1.3.2 |
636842-3 | 3-Major | K51472519, BT636842 | A FastL4 virtual server may drop a FIN packet when mirroring is enabled | 15.1.0, 14.1.2.5, 13.1.3.2, 12.1.5.1 |
601189-3 | 3-Major | BT601189 | The BIG-IP system might send TCP packets out of order in fastl4 in syncookie mode | 15.1.0, 14.1.2.5, 13.1.3.2, 12.1.5.1 |
769309-3 | 4-Minor | BT769309 | DB monitor reconnects to server on every probe when count = 0 | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2, 12.1.5.3 |
760683-2 | 4-Minor | BT760683 | RST from non-floating self-ip may use floating self-ip source mac-address | 15.1.0, 14.1.2.5, 13.1.3.2 |
754003-1 | 4-Minor | K73202036, BT754003 | Configuring SSL Forward Proxy and an OCSP stapling profile may allow a connection to a website with a revoked certificate | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2 |
747628-3 | 4-Minor | BT747628 | BIG-IP sends spurious ICMP PMTU message to server | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
744210-1 | 4-Minor | BT744210 | DHCPv6 does not have the ability to override the hop limit from the client. | 15.0.0, 14.1.2.3, 13.1.3.2 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
772233-1 | 3-Major | BT772233 | IPv6 RTT metric is not set when using collection protocols DNS_DOT and DNS_REV. | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3.2 |
761032-4 | 3-Major | K36328238, BT761032 | TMSH displays TSIG keys | 15.1.0, 14.1.2.3, 14.0.1.1, 13.1.3.2 |
699512-1 | 3-Major | BT699512 | UDP packet may be dropped when queued in parallel with another packet | 14.1.0, 13.1.3.2 |
672491-5 | 3-Major | K10990182, BT672491 | net resolver uses internal IP as source if matching wildcard forwarding virtual server | 14.0.0, 13.1.3.2, 12.1.3.6, 11.6.5.3 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
813945-1 | 2-Critical | BT813945 | PB core dump while processing many entities | 15.1.0, 14.1.2.3, 13.1.3.2 |
775105-1 | 2-Critical | BT775105 | False positive on bot defense logs | 14.0.1.1, 13.1.3.2 |
812341-1 | 3-Major | BT812341 | Patch or Delete commands take a long time to complete when modifying an ASM signature set. | 15.1.0, 14.1.2.3, 13.1.3.2 |
800453-1 | 3-Major | K72252057, BT800453 | False positive virus violations | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2 |
783513-1 | 3-Major | BT783513 | ASU is very slow on device with hundreds of policies due to logging profile handling | 15.1.0, 14.1.2.3, 13.1.3.2 |
739618-1 | 3-Major | BT739618 | When loading AWAF or MSP license, cannot set rule to control ASM in LTM policy | 15.1.0.2, 14.1.2.3, 14.1.0, 13.1.3.2 |
727107-2 | 3-Major | BT727107 | Request Logs are not stored locally due to shmem pipe blockage | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2, 12.1.5 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
756102-3 | 2-Critical | BT756102 | TMM can crash with core on ABORT signal due to non-responsive AVR code | 15.1.0, 15.0.1.1, 14.1.0.6, 13.1.3.2 |
797785-3 | 3-Major | BT797785 | AVR reports no ASM-Anomalies data. | 15.1.0, 15.0.1.3, 14.1.2.1, 13.1.3.2 |
792265-1 | 3-Major | BT792265 | Traffic logs does not include the BIG-IQ tags | 15.1.0, 15.0.1.3, 14.1.2.1, 13.1.3.2 |
781581-4 | 3-Major | BT781581 | Monpd uses excessive memory on requests for network_log data | 15.1.0, 15.0.1.3, 14.1.2.3, 13.1.3.2 |
703196-5 | 3-Major | BT703196 | Reports for AVR are missing data | 14.0.0, 13.1.3.2 |
696191-1 | 3-Major | BT696191 | AVR-related disk partitions can get full during upgrade★ | 14.0.0, 13.1.3.2 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
811145-4 | 2-Critical | BT811145 | VMware View resources with SAML SSO are not working | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
784989-4 | 2-Critical | BT784989 | TMM may crash with panic message: Assertion 'cookie name exists' failed | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
777173-4 | 2-Critical | BT777173 | Citrix vdi iApp fails in APM standalone deployments with "HTTP header transformation feature not licensed" error | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
725505-2 | 2-Critical | BT725505 | SNAT settings in network resource are not applied after FastL4 profile is updated | 13.1.3.2 |
618641-1 | 2-Critical | BT618641 | In rare cases VDI plugin might leak memory or crash while processing client connections | 14.0.0, 13.1.3.2 |
815753-4 | 3-Major | BT815753 | TMM leaks memory when explicit SWG is configured with Kerberos authentication | 15.1.0, 15.0.1.1, 14.0.1.1, 13.1.3.2 |
799149 | 3-Major | BT799149 | Authentication fails with empty password | 14.1.2.7, 13.1.3.2 |
798261-4 | 3-Major | BT798261 | APMD fails to create session variables if spanning is enabled on SWG transparent virtual server | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3.2 |
788417-3 | 3-Major | BT788417 | Remote Desktop client on macOS may show resource auth token on credentials prompt | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
787477-1 | 3-Major | BT787477 | Export fails from partitions with '-' as second character | 15.1.0, 14.1.2.1, 13.1.3.2 |
768025-1 | 3-Major | BT768025 | SAML requests/responses fail with "failed to find certificate" | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3.2 |
766577-4 | 3-Major | BT766577 | APMD fails to send response to client and it already closed connection. | 15.1.0, 15.0.1.1, 14.1.2.3, 14.0.1.1, 13.1.3.2, 12.1.5 |
725040-3 | 3-Major | BT725040 | Auto-update fails for F5 Helper Applications on Linux | 14.1.0, 13.1.3.2 |
723278-1 | 3-Major | BT723278 | Radius Accounting-Request (STOP) always includes AVP Framed-IP-Address=0.16.0.0 when Network Access rescource configured with IPv4 & IPv6 | 15.0.0, 13.1.3.2 |
697590-4 | 3-Major | BT697590 | APM iRule ACCESS::session remove fails outside of Access events | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
653210-1 | 3-Major | BT653210 | Rare resets during the login process | 16.0.0, 14.1.2.4, 13.1.3.2 |
643935-2 | 3-Major | BT643935 | Rewriting may cause an infinite loop while processing some objects | 15.0.0, 14.1.2.3, 14.0.1.1, 13.1.3.2 |
719589-3 | 4-Minor | BT719589 | GUI and CLI category lookup test tool returning different categories compared to the actual data-plane traffic | 15.1.0, 14.1.2.7, 13.1.3.2 |
684414-2 | 4-Minor | BT684414 | Retrieving too many groups is causing out of memory errors in TMUI and VPE | 14.0.0, 13.1.3.2, 12.1.3.2 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
813657 | 3-Major | BT813657 | MRF SIP ALG with SNAT incorrectly detects ingress queue full | 13.1.3.2 |
811745-4 | 3-Major | BT811745 | Failover between clustered DIAMETER devices can cause mirror connections to be disconnected | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
787901 | 2-Critical | BT787901 | While deleting a DoS profile, tmm might core in sPVA | 13.1.3.2 |
778869-1 | 2-Critical | K72423000, BT778869 | ACLs and other AFM features (e.g., IPI) may not function as designed | 15.1.0, 14.1.2.5, 14.0.1.1, 13.1.3.2 |
747922-2 | 2-Critical | BT747922 | With AFM enabled, during bootup, there is a small possibility of a tmm crash | 15.0.0, 14.1.0.2, 13.1.3.2 |
761345-1 | 3-Major | BT761345 | Additional config-sync may be required after blob compilation on a HA setup in manual config-sync mode | 15.1.0, 14.1.2.3, 13.1.3.2 |
738284-4 | 3-Major | BT738284 | Creating or deleting rule list results in warning message: Schema object encode failed | 15.1.0, 15.0.1.1, 14.1.2.3, 13.1.3.2 |
679722-1 | 3-Major | BT679722 | Configuration sync failure involving self IP references | 14.0.0, 13.1.3.2 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
753014-1 | 3-Major | BT753014 | PEM iRule action with RULE_INIT event fails to attach to PEM policy | 15.0.0, 14.1.2.7, 13.1.3.2, 12.1.5.3 |
747065-3 | 3-Major | BT747065 | PEM iRule burst of session ADDs leads to missing sessions | 15.0.0, 13.1.3.2 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
804185-3 | 3-Major | BT804185 | Some WebSafe request signatures may not work as expected | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3.2 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
803477-1 | 3-Major | BT803477 | BaDoS State file load failure when signature protection is off | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3.2 |
767045 | 4-Minor | BT767045 | TMM cores while applying policy | 15.1.0, 14.1.2.3, 13.1.3.2 |
711708-1 | 4-Minor | BT711708 | Default disabled DoS profile cannot be attached to virtual server because of BADOS '2 virtual servers limitation' | 14.1.0, 13.1.3.2 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
674795-2 | 4-Minor | BT674795 | tmsh help/man page incorrectly state that the urldb feedlist polling interval is in seconds, when it should be hours. | 14.1.0, 13.1.3.2, 12.1.5.3 |
Cumulative fixes from BIG-IP v13.1.3.1 that are included in this release
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
688627-1 | 3-Major | BT688627 | OPT-0043 40G optical transceiver cannot be unbundled into 4x10G | 15.0.0, 13.1.3.1 |
Cumulative fixes from BIG-IP v13.1.3 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
809377-4 | CVE-2019-6649 | K05123525 | AFM ConfigSync Hardening | 15.0.1, 14.1.2, 14.0.1, 13.1.3 |
771873-3 | CVE-2019-6642 | K40378764, BT771873 | TMSH Hardening | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3, 12.1.5, 11.6.5.1 |
767653-2 | CVE-2019-6660 | K23860356, BT767653 | Malformed HTTP request can result in endless loop in an iRule script | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3 |
758065-2 | CVE-2019-6667 | K82781208, BT758065 | TMM may consume excessive resources while processing FIX traffic | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5, 11.6.5.1 |
757023-4 | CVE-2018-5743 | K74009656, BT757023 | BIND vulnerability CVE-2018-5743 | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5, 11.6.5.1 |
756538-1 | CVE-2019-6645 | K15759349, BT756538 | Failure to open data channel for active FTP connections mirrored across an high availability (HA) pair. | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3, 12.1.5, 11.6.5.1 |
754103-2 | CVE-2019-6644 | K75532331, BT754103 | iRulesLX NodeJS daemon does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.4.1 |
739971-2 | CVE-2018-5391 | K74374841, BT739971 | Linux kernel vulnerability: CVE-2018-5391 | 15.0.0, 14.1.2.5, 14.0.1.1, 13.1.3, 12.1.5, 11.6.5.1 |
726393-4 | CVE-2019-6643 | K36228121, BT726393 | DHCPRELAY6 can lead to a tmm crash | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5, 11.6.5.1 |
715923-1 | CVE-2018-15317 | K43625118, BT715923 | When processing TLS traffic TMM may terminate connections unexpectedly | 14.1.0, 14.0.0.3, 13.1.3, 12.1.5, 11.6.3.3 |
757455-1 | CVE-2019-6647 | K87920510, BT757455 | Excessive resource consumption when processing REST requests | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5, 11.6.5.1 |
773649-4 | CVE-2019-6656 | K23876153, BT773649 | APM Client Logging | 15.1.0, 15.0.1.1, 14.1.2, 14.0.0.5, 13.1.3, 12.1.5.1 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
749704-3 | 4-Minor | BT749704 | GTPv2 Serving-Network field with mixed MNC digits | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
774445-3 | 1-Blocking | K74921042, BT774445 | BIG-IP Virtual Edition does not pass traffic on ESXi 6.7 Update 2 | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3 |
769809-2 | 2-Critical | BT769809 | The vCMP guests 'INOPERATIVE' after upgrade | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5 |
760408-1 | 2-Critical | BT760408 | System Integrity Status: Invalid after BIOS update★ | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3 |
757722-1 | 2-Critical | BT757722 | Unknown notify message types unsupported in IKEv2 | 15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
756402-1 | 2-Critical | BT756402 | Re-transmitted IPsec packets can have garbled contents | 15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
756071-1 | 2-Critical | BT756071 | MCPD crash | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
753650 | 2-Critical | BT753650 | The BIG-IP system reports frequent kernel page allocation failures. | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
748205-1 | 2-Critical | BT748205 | SSD bay identification incorrect for RAID drive replacement★ | 15.0.0, 14.1.2.5, 13.1.3, 12.1.5 |
734539-3 | 2-Critical | BT734539 | The IKEv1 racoon daemon can crash on multiple INVALID-SPI payloads | 14.1.0, 14.0.1.1, 13.1.3, 12.1.5 |
708968-2 | 2-Critical | BT708968 | OSPFv3 failure to create a route entry for IPv4-Mapped IPv6 Address | 14.1.0, 14.0.1.1, 13.1.3 |
671741-3 | 2-Critical | BT671741 | LCD on iSeries devices can lock at red 'loading' screen. | 14.0.0, 13.1.3, 12.1.5 |
648270-3 | 2-Critical | BT648270 | mcpd can crash if viewing a fast-growing log file through the GUI | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3, 12.1.5.3, 11.6.5.2 |
756153-2 | 3-Major | BT756153 | Add diskmonitor support for MySQL /var/lib/mysql | 15.1.0, 14.1.2.7, 13.1.3, 12.1.4.1 |
749785-1 | 3-Major | BT749785 | nsm can become unresponsive when processing recursive routes | 15.0.0, 14.1.2.5, 13.1.3, 12.1.5.3 |
746266-1 | 3-Major | BT746266 | A vCMP guest VLAN MAC mismatch across blades. | 15.0.0, 14.1.2.3, 13.1.3, 12.1.5 |
735565-1 | 3-Major | BT735565 | BGP neighbor peer-group config element not persisting | 14.1.0, 14.0.1.1, 13.1.3, 12.1.4.1 |
723553-1 | 3-Major | BT723553 | BIG-IP installations on RAID systems (old style) may not boot★ | 14.1.0, 13.1.3 |
720610 | 3-Major | BT720610 | Automatic Update Check logs false 'Update Server unavailable' message on every run | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.2.7, 13.1.3 |
716166-4 | 3-Major | BT716166 | Dynamic routing not added when conflicting self IPs exist | 14.1.0, 13.1.3, 12.1.4.1, 11.6.5.1 |
709544-2 | 3-Major | BT709544 | VCMP guests in HA configuration become Active/Active during upgrade★ | 14.1.0, 14.0.0, 13.1.3, 12.1.4.1 |
705037-2 | 3-Major | K32332000, BT705037 | System may exhibit duplicate if_index, which in some cases lead to nsm daemon restart | 14.1.2.3, 14.1.0, 14.0.1.1, 13.1.3, 12.1.4 |
702310-1 | 3-Major | BT702310 | The ':l' and ':h' options are not available on the tmm interface in tcpdump | 14.0.0, 13.1.3 |
693388-2 | 3-Major | BT693388 | Log additional HSB registers when device becomes unresponsive | 14.0.0, 13.1.3, 12.1.4.1 |
667618-1 | 3-Major | BT667618 | Hardware SYN Cookies may not deactivate after the SYN attack ends and valid TCP traffic starts | 14.1.0, 13.1.3 |
620954-5 | 3-Major | BT620954 | Rare problem in pam_tally; message: PAM Couldn't lock /var/log/pam/tallylog : Resource temporarily unavailable | 14.0.0, 13.1.3, 12.1.5.1 |
721526-2 | 4-Minor | BT721526 | tcpdump fails to write verbose packet data to file | 14.1.0, 13.1.3, 12.1.5.3 |
691171-1 | 4-Minor | BT691171 | static and dynamically learned blackhole route from ZebOS cannot be deleted | 14.1.0, 14.0.0, 13.1.3 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
759968 | 1-Blocking | BT759968 | Distinct vCMP guests are able to cluster with each other. | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3, 12.1.5 |
757441-2 | 2-Critical | BT757441 | Specific sequence of packets causes Fast Open to be effectively disabled | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3 |
757391-3 | 2-Critical | BT757391 | Datagroup iRule command class can lead to memory corruption | 15.0.0, 14.1.2.5, 13.1.3, 12.1.5 |
756450-2 | 2-Critical | BT756450 | Traffic using route entry that's more specific than existing blackhole route can cause core | 15.0.0, 14.1.2.3, 13.1.3, 12.1.5, 11.6.5.1 |
755585-3 | 2-Critical | BT755585 | mcpd can restart on secondary blades if a policy is created, published, and attached to a virtual server in a single transaction | 15.0.0, 14.1.2.1, 13.1.3 |
746710-2 | 2-Critical | BT746710 | Use of HTTP::cookie after HTTP:disable causes TMM core | 15.0.0, 14.1.2.1, 13.1.3 |
742184-1 | 2-Critical | BT742184 | TMM memory leak | 15.0.0, 14.1.0.2, 13.1.3 |
740228-1 | 2-Critical | BT740228 | TMM crash while sending a DHCP Lease Query to a DHCP server | 14.1.0, 14.0.0.5, 13.1.3, 12.1.5.3 |
724214-3 | 2-Critical | BT724214 | TMM core when using Multipath TCP | 14.1.0, 14.0.0.5, 13.1.3, 12.1.5, 11.6.5.1 |
667779-1 | 2-Critical | BT667779 | iRule commands may cause the TMM to crash in very rare situations. | 14.0.0, 13.1.3, 12.1.5, 11.6.5.2 |
794493 | 3-Major | BT794493 | Creating Client SSL profile via tmsh or iControl REST and specifying 'cert' and 'key' incorrectly leaves inherit-certkeychain as true | 13.1.3 |
790205-2 | 3-Major | BT790205 | Adding a more-specific route to a child route domain that overrides the default route in the default route domain can cause TMM to core | 15.1.0, 15.0.1.1, 14.1.2.7, 14.0.1.1, 13.1.3, 12.1.5.3 |
760771-3 | 3-Major | BT760771 | FastL4-steered traffic might cause SSL resume handshake delay | 15.0.0, 14.1.2.3, 13.1.3 |
760550-3 | 3-Major | BT760550 | Retransmitted TCP packet has FIN bit set | 15.1.0, 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3, 12.1.5, 11.6.5.1 |
757442-1 | 3-Major | BT757442 | A missed SYN cookie check causes crash at the standby TMM in HA mirroring system | 15.0.0, 14.1.4, 13.1.3 |
754349 | 3-Major | BT754349 | FTP connections to virtual server drop when both sides of data channel are offloaded via FastL4 | 14.0.1.1, 13.1.3 |
753594-3 | 3-Major | BT753594 | In-TMM monitors may have duplicate instances or stop monitoring | 15.0.0, 14.1.3.1, 13.1.3 |
753514-1 | 3-Major | BT753514 | Large configurations containing LTM Policies load slowly | 15.0.0, 14.1.2.3, 14.0.1.1, 13.1.3 |
749414-2 | 3-Major | BT749414 | Invalid monitor rule instance identifier error | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3, 12.1.5, 11.6.5.2 |
746922-4 | 3-Major | BT746922 | When there is more than one route domain in a parent-child relationship, outdated routing entry selected from the parent route domain may not be invalidated on routing table changes in child route domain. | 15.0.0, 14.1.2.7, 14.0.1.1, 13.1.3, 12.1.4.1 |
726001-1 | 3-Major | BT726001 | Rapid datagroup updates can cause type corruption | 14.1.0, 13.1.3 |
720219 | 3-Major | K13109068, BT720219 | HSL::log command can fail to pick new pool member if last picked member is 'checking' | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.3, 12.1.5 |
719304-2 | 3-Major | BT719304 | Inconsistent node ICMP monitor operation for IPv6 nodes | 15.0.0, 14.1.4, 13.1.3 |
712919-1 | 3-Major | K54802336, BT712919 | Removing an iRule from a Virtual Server may prevent executing other iRules on the same Virtual Server. | 15.0.0, 14.1.2.3, 14.0.1.1, 13.1.3 |
705112-2 | 3-Major | BT705112 | DHCP server flows are not re-established after expiration | 16.0.0, 15.1.0.2, 14.1.2.5, 13.1.3, 12.1.4.1, 11.5.9 |
675367-2 | 3-Major | K95393925, BT675367 | The IMAP and POP3 monitors might fail if the mail server supports GSSAPI authentication | 14.0.0, 13.1.3 |
604811-2 | 3-Major | BT604811 | Under certain conditions TMM may crash while processing OneConnect traffic | 14.0.0, 13.1.3, 12.1.5.3, 11.6.3.2 |
273104-1 | 3-Major | Modulate tcp_now on a per-tuple basis to hide uptime in tcp timestamps | 14.0.0, 13.1.3, 12.1.4.1 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
759721-4 | 3-Major | K03332436, BT759721 | DNS GUI does not follow best practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3 |
754901-3 | 3-Major | BT754901 | Frequent zone update notifications may cause TMM to restart | 15.0.0, 14.1.2.5, 13.1.3 |
750213-2 | 3-Major | K25351434, BT750213 | DNS FPGA Hardware-accelerated Cache can improperly respond to DNS queries that contain EDNS OPT Records. | 15.0.0, 14.1.2.5, 13.1.3, 12.1.5 |
726412-2 | 4-Minor | BT726412 | Virtual server drop down missing objects on pool creation | 14.1.0, 13.1.3, 12.1.4.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
781637-4 | 3-Major | BT781637 | ASM brute force counts unnecessary failed logins for NTLM | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3 |
781605-1 | 3-Major | BT781605 | Fix RFC issue with the multipart parser | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3, 12.1.6, 11.6.5.3 |
781069-4 | 3-Major | BT781069 | Bot Defense challenge blocks requests with long Referer headers | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3 |
773553-4 | 3-Major | BT773553 | ASM JSON parser false positive. | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3, 12.1.5 |
769981-3 | 3-Major | BT769981 | bd crashes in a specific scenario | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3 |
764373-1 | 3-Major | BT764373 | 'Modified domain cookie' violation with multiple enforced domain cookies with different paths | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3 |
763001-2 | 3-Major | K70312000, BT763001 | Web-socket enforcement might lead to a false negative | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
761941-3 | 3-Major | BT761941 | ASM does not remove CSRT token query parameter before forwarding a request to the backend server | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
761231-4 | 3-Major | K79240502, BT761231 | Bot Defense Search Engines getting blocked after configuring DNS correctly | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.0.5, 13.1.3, 12.1.5 |
739900-1 | 3-Major | BT739900 | All Policies are created with 3 new Signature Sets After Creation of a Policy using Application Ready Templates | 14.1.0, 13.1.3 |
713051 | 3-Major | BT713051 | PB generates a suggestion to add a disallowed filtetype with empty name. | 13.1.3 |
686763-1 | 3-Major | BT686763 | asm_start is consuming too much memory | 14.0.0, 13.1.3, 12.1.5.3 |
686500-1 | 3-Major | BT686500 | Adding user defined signature on device with many policies is very slow | 14.0.0, 13.1.3 |
675673-1 | 3-Major | BT675673 | Policy history files should be limited by settings in a configuration file. | 14.1.0, 13.1.3 |
768761-4 | 4-Minor | BT768761 | Improved accept action description for suggestions to disable signature/enable metacharacter in policy | 15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
761553-4 | 4-Minor | BT761553 | Text for analyzed requests improved for suggestions that were created as result of absence of violations in traffic | 15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
761549-4 | 4-Minor | BT761549 | Traffic Learning: Accept and Stage action is shown only in case entity is not in staging | 15.1.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
750689-1 | 4-Minor | BT750689 | Request Log: Accept Request button available when not needed | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3 |
749184-4 | 4-Minor | BT749184 | Added description of subviolation for the suggestions that enabled/disabled them | 15.1.0, 15.0.1.3, 14.1.0.6, 14.0.1.1, 13.1.3 |
747560-3 | 4-Minor | BT747560 | ASM REST: Unable to download Whitehat vulnerabilities | 15.0.0, 14.1.0.6, 13.1.3, 12.1.5.1 |
695878-4 | 4-Minor | BT695878 | Signature enforcement issue on specific requests | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3, 12.1.5, 11.5.6 |
613728-2 | 4-Minor | BT613728 | Import/Activate Security policy with 'Replace policy associated with virtual server' option fails | 14.0.0, 13.1.3, 12.1.4 |
769061-4 | 5-Cosmetic | BT769061 | Improved details for learning suggestions to enable violation/sub-violation | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.1.1, 13.1.3 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
753485-2 | 2-Critical | K50285521, BT753485 | AVR global settings are being overridden by high availability (HA) peers | 15.1.0, 15.0.1, 15.0.0, 14.1.2, 13.1.3 |
771025-2 | 3-Major | BT771025 | AVR send domain names as an aggregate | 15.1.0, 15.0.1.3, 14.1.0.6, 14.0.0.5, 13.1.3 |
688544-1 | 3-Major | BT688544 | SWG reports on BIG-IQ show same series as 'Allowed' and 'Blocked' at the same time | 14.0.0, 13.1.3 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
760130-1 | 2-Critical | BT760130 | [APM] Memory leak when PingAccess encounters error after sending traffic data to PingAccess SDK | 15.0.0, 14.1.3.1, 13.1.3 |
753370-1 | 2-Critical | BT753370 | RADIUS auth might not be working as configured when there is change in RADIUS auth config name. | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.3 |
745600-3 | 2-Critical | BT745600 | Tmm crash and core using iRule | 14.1.0, 13.1.3 |
741535-1 | 2-Critical | BT741535 | Memory leak when using SAML or Form-based Client-initiated SSO | 14.1.0, 13.1.3 |
723402-2 | 2-Critical | BT723402 | Apmd crashes running command: tmsh restart sys service all | 14.1.0, 13.1.3 |
686282-2 | 2-Critical | BT686282 | APMD intermittently crash when processing access policies | 14.0.0, 13.1.3, 12.1.3.2 |
783817-4 | 3-Major | BT783817 | UI becomes unresponsive when accessing Access active session information | 15.1.0, 15.0.1.1, 14.1.2.1, 14.0.1.1, 13.1.3 |
775621-4 | 3-Major | BT775621 | urldb memory grows past the expected ~3.5GB | 15.1.0, 15.0.1.3, 14.1.2.1, 13.1.3 |
765621-1 | 3-Major | BT765621 | POST request being rejected when using OAuth Resource Server mode | 15.1.0, 13.1.3 |
760974-1 | 3-Major | BT760974 | TMM SIGABRT while evaluating access policy | 15.1.0, 13.1.3 |
759638-1 | 3-Major | BT759638 | APM current active and established session counts out of sync after failover | 15.1.0, 13.1.3 |
754542-4 | 3-Major | BT754542 | TMM may crash when using RADIUS Accounting agent | 15.0.0, 14.1.0.6, 13.1.3 |
750823-3 | 3-Major | BT750823 | Potential memory leaks in TMM when Access::policy evaluate command failed to send the request to APMD | 15.0.0, 14.1.2.1, 13.1.3 |
750631-1 | 3-Major | BT750631 | There may be a latency between session termination and deletion of its associated IP address mapping | 15.0.0, 14.1.2.7, 13.1.3 |
750170-1 | 3-Major | BT750170 | SP Connector config changes causes BIG-IP tmm core sometimes during handling of SAML SLO request | 15.0.0, 13.1.3 |
749161-1 | 3-Major | Problem sync policy contains non-ASCII characters | 15.0.0, 14.1.2.1, 13.1.3 | |
747725-2 | 3-Major | BT747725 | Kerberos Auth agent may override settings that manually made to krb5.conf | 15.0.0, 14.1.2.5, 13.1.3, 12.1.4.1 |
744532-2 | 3-Major | BT744532 | Websso fails to decrypt secured session variables | 14.1.0, 13.1.3 |
600985-3 | 3-Major | BT600985 | Network access tunnel data stalls | 15.0.0, 14.1.2.7, 13.1.3 |
770621-1 | 4-Minor | BT770621 | [Portal Access] HTTP 308 redirect does not get rewritten | 15.1.0, 13.1.3 |
737603-1 | 4-Minor | BT737603 | Apmd leaks memory when executing per-session policy via iRule | 14.1.0, 14.0.1.1, 13.1.3 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
759077-4 | 3-Major | BT759077 | MRF SIP filter queue sizes not configurable | 15.1.0, 15.0.1.4, 14.1.0.6, 14.0.1.1, 13.1.3 |
748253-3 | 3-Major | BT748253 | Race condition between clustered DIAMETER devices can cause the standby to disconnect its mirror connection | 15.0.0, 14.1.2.1, 13.1.3 |
745628-3 | 3-Major | BT745628 | MRF SIP ALG with SNAT does not translate media addresses in SDP after NOTIFY message | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.3 |
745514-3 | 3-Major | BT745514 | MRF SIP ALG with SNAT does not translate media addresses in SDP after SUBSCRIBE message | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.3 |
745404-2 | 3-Major | BT745404 | MRF SIP ALG does not reparse SDP payload if replaced | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.3, 12.1.5.2 |
701680-2 | 3-Major | BT701680 | MBLB rate-limited virtual server periodically stops sending packets to the server for a few seconds | 14.0.0, 13.1.3, 12.1.4.1 |
747909-3 | 4-Minor | BT747909 | GTPv2 MEI and Serving-Network fields decoded incorrectly | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.3, 12.1.5.3, 11.6.5.1 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
763121-1 | 2-Critical | BT763121 | Utilizing the AFM Packet Tester tool while a TCP Half Open attack is underway can crash TMM. | 15.0.0, 14.1.2.8, 13.1.3 |
757359-3 | 2-Critical | BT757359 | pccd crashes when deleting a nested Address List | 15.0.0, 14.1.0.6, 13.1.3 |
752363 | 2-Critical | BT752363 | Internally forwarded flows can get dropped with AFM L4 BDoS feature enabled | 15.0.0, 14.1.0.2, 13.1.3 |
777733-1 | 3-Major | BT777733 | DoS profile default values cause config load failure on upgrade | 15.1.0, 13.1.3 |
771173-1 | 3-Major | BT771173 | FastL4 profile syn-cookie-enable attribute is not being rolled forward correctly.★ | 15.1.0, 15.0.1.3, 14.1.2.5, 13.1.3 |
757306-2 | 3-Major | BT757306 | SNMP MIBS for AFM NAT do not yet exist | 15.1.0, 15.0.1, 14.1.2, 13.1.3 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
726665-2 | 2-Critical | BT726665 | tmm core dump due to SEGFAULT | 14.1.0, 14.0.1.1, 13.1.3 |
760438-1 | 3-Major | BT760438 | PEM iRule to set policy in rigorous loop may crash tmm due to rare timing conditions | 15.0.0, 14.1.2.1, 13.1.3 |
759192-1 | 3-Major | BT759192 | TMM core during display of PEM session under some specific conditions | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3 |
756311-1 | 3-Major | BT756311 | High CPU during erroneous deletion | 15.0.0, 14.1.2.1, 14.0.1.1, 13.1.3 |
753163-2 | 3-Major | BT753163 | PEM does not initiate connection request with PCRF/OCS if failover occurs after 26 days | 15.0.0, 14.1.2.1, 13.1.3 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
775013-4 | 3-Major | BT775013 | TIME EXCEEDED alert has insufficient data for analysis | 15.1.0, 15.0.1.1, 14.1.2.1, 13.1.3 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
752803-2 | 2-Critical | BT752803 | CLASSIFICATION_DETECTED running reject can lead to a tmm core | 15.0.0, 14.1.0.6, 13.1.3 |
Cumulative fixes from BIG-IP v13.1.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
807477-9 | CVE-2019-6650 | K04280042, BT807477 | ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
797885-4 | CVE-2019-6649 | K05123525, BT797885 | ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
796469-2 | CVE-2019-6649 | K05123525, BT796469 | ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
810557-9 | CVE-2019-6649 | K05123525, BT810557 | ASM ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
799617-4 | CVE-2019-6649 | K05123525, BT799617 | ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
799589-4 | CVE-2019-6649 | K05123525, BT799589 | ConfigSync Hardening | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
794389-9 | CVE-2019-6651 | K89509323, BT794389 | iControl REST endpoint response inconsistency | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5 |
794413-9 | CVE-2019-6471 | K10092301, BT794413 | BIND vulnerability CVE-2019-6471 | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5, 11.5.10 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
744937-9 | 3-Major | K00724442, BT744937 | BIG-IP DNS and GTM DNSSEC security exposure | 15.1.0, 15.0.1, 14.1.2, 14.0.1, 13.1.3, 12.1.5, 11.6.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
760622-2 | 3-Major | BT760622 | Allow Device Certificate renewal from BIG-IP Configuration Utility | 16.0.0, 15.1.0.5 |
760363-2 | 3-Major | BT760363 | Update Alias Address field with default placeholder text | 13.1.3.2 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
807445 | 3-Major | BT807445 | Replaced ISC_TRUE and ISC_FALSE with true and false |
Cumulative fixes from BIG-IP v13.1.1.5 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
757025-3 | CVE-2018-5744 | K00040234, BT757025 | BIND Update | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
756774-4 | CVE-2019-6612 | K24401914, BT756774 | Aborted DNS queries to a cache may cause a TMM crash | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
754944-3 | CVE-2019-6626 | K00432398, BT754944 | AVR reporting UI does not follow best practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4 |
754345-3 | CVE-2019-6625 | K79902360, BT754345 | WebUI does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.5.1 |
753975 | CVE-2019-6666 | K92411323, BT753975 | TMM may crash while processing HTTP traffic with webacceleration profile | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
753776-1 | CVE-2019-6624 | K07127032, BT753776 | TMM may consume excessive resources when processing UDP traffic | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
749879-4 | CVE-2019-6611 | K47527163, BT749879 | Possible interruption while processing VPN traffic | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
748502-3 | CVE-2019-6623 | K72335002, BT748502 | TMM may crash when processing iSession traffic | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
737731-2 | CVE-2019-6622 | K44885536, BT737731 | iControl REST input sanitization | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.5.1 |
737574-2 | CVE-2019-6621 | K20541896, BT737574 | iControl REST input sanitization★ | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.5, 11.6.4, 11.5.9 |
737565-2 | CVE-2019-6620 | K20445457, BT737565 | iControl REST input sanitization | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.5, 11.6.5.1 |
726327-2 | CVE-2018-12120 | K37111863, BT726327 | NodeJS debugger accepts connections from any host | 15.0.0, 14.1.0.6, 13.1.1.5 |
791369-4 | CVE-2019-6662 | K01049383 | The REST framework may reflect client data in error logs | 13.1.1.5 |
757027-3 | CVE-2019-6465 | K01713115, BT757027 | BIND Update | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
757026-3 | CVE-2018-5745 | K25244852, BT757026 | BIND Update | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
753796-2 | CVE-2019-6640 | K40443301 | SNMP does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.5.9 |
750460-3 | CVE-2019-6639 | K61002104, BT750460 | Subscriber management configuration GUI | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
750187-3 | CVE-2019-6637 | K29149494, BT750187 | ASM REST may consume excessive resources | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
745713-1 | CVE-2019-6619 | K94563344, BT745713 | TMM may crash when processing HTTP/2 traffic | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
745387-3 | CVE-2019-6618 | K07702240, BT745387 | Resource-admin user roles can no longer get bash access | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
745371-2 | CVE-2019-6636 | K68151373, BT745371 | AFM GUI does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.5.1 |
745257-3 | CVE-2018-14634 | K20934447, BT745257 | Linux kernel vulnerability: CVE-2018-14634 | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.5, 11.6.4 |
745165-3 | CVE-2019-6617 | K38941195, BT745165 | Users without Advanced Shell Access are not allowed SFTP access | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
742226-2 | CVE-2019-6635 | K11330536, BT742226 | TMSH platform_check utility does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
710857-2 | CVE-2019-6634 | K64855220 | iControl requests may cause excessive resource usage | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
703835-2 | CVE-2019-6616 | K82814400, BT703835 | When using SCP into BIG-IP systems, you must specify the target filename | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
702472-3 | CVE-2019-6615 | K87659521, BT702472 | Appliance Mode Security Hardening | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
702469-3 | CVE-2019-6633 | K73522927, BT702469 | Appliance mode hardening in scp | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.5, 11.6.5.1 |
698376-3 | CVE-2019-6614 | K46524395, BT698376 | Non-admin users have limited bash commands and can only write to certain directories | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
673842-4 | CVE-2019-6632 | K01413496, BT673842 | VCMP does not follow best security practices | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
752835-3 | 2-Critical | K46971044, BT752835 | Mitigate mcpd out of memory error with auto-sync enabled. | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.5.1 |
750586-1 | 2-Critical | BT750586 | HSL may incorrectly handle pending TCP connections with elongated handshake time. | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.5 |
707013 | 2-Critical | BT707013 | vCMP host secondary member's cluster.conf file may replaced by that of vCMP guest | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5 |
699515-1 | 2-Critical | nsm cores during update of nexthop for ECMP recursive route | 15.0.0, 14.1.2.5, 13.1.1.5 | |
621260-4 | 2-Critical | BT621260 | mcpd core on iControl REST reference to non-existing pool | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5, 12.1.5.1, 11.6.5.1 |
760222-5 | 3-Major | BT760222 | SCP fails unexpected when FIPS mode is enabled | 15.0.0, 14.1.0.3, 14.0.0.5, 13.1.1.5 |
757414 | 3-Major | BT757414 | GUI Network Map slow page load with large configuration | 13.1.1.5 |
756088-1 | 3-Major | BT756088 | The BIG-IP might respond incorrectly to ICMP echo requests or incorrectly add/remove dynamic routes to a virtual-address | 15.0.0, 13.1.1.5 |
754567 | 3-Major | BT754567 | Child clientSSL profile's inherit-certkeychain can be unexpectedly set to false after updating the certificate file | 13.1.1.5 |
751011-1 | 3-Major | BT751011 | ihealth.sh script and qkview locking mechanism not working | 15.0.0, 14.1.0.2, 13.1.1.5 |
750447-1 | 3-Major | BT750447 | GUI VLAN list page loading slowly with 50 records per screen | 15.0.0, 14.1.0.2, 13.1.1.5 |
750318-1 | 3-Major | BT750318 | HTTPS monitor does not appear to be using cert from server-ssl profile | 15.0.0, 14.1.2.3, 13.1.1.5 |
748187-2 | 3-Major | BT748187 | 'Transaction Not Found' Error on PATCH after Transaction has been Created | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.4 |
740345-1 | 3-Major | BT740345 | TMM core files seen on standby device after failover, when connection mirroring, session mirroring and OCSP stapling are enabled. | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
725791-4 | 3-Major | K44895409, BT725791 | Potential HW/HSB issue detected | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.5.2, 11.6.5.2 |
723794-3 | 3-Major | BT723794 | PTI (Meltdown) mitigation should be disabled on AMD-based platforms | 13.1.1.5, 12.1.4.1, 11.6.5.1 |
722380-2 | 3-Major | BT722380 | The BIG-IP system reboots while TMM is still writing a core file, thus producing a truncated core. | 14.1.0, 13.1.1.5, 12.1.5.2 |
721805 | 3-Major | BT721805 | Traffic Policy edit to datagroup errors on adding ASM disable action | 13.1.1.5 |
720819-2 | 3-Major | BT720819 | Certain platforms may take longer than expected to detect and recover from HSB lock-ups | 14.1.0, 13.1.1.5, 12.1.4.1 |
720269-2 | 3-Major | BT720269 | TACACS audit logging may append garbage characters to the end of log strings | 14.1.0, 14.0.1.1, 13.1.1.5, 12.1.4.1 |
714626-2 | 3-Major | BT714626 | When licensing through a proxy, setting the db variables for proxy.host, proxy.port, etc., has no effect. | 14.0.0, 13.1.1.5 |
701898-1 | 3-Major | BT701898 | Certain virtual address route-advertisement settings break upgrades from 13.0.0 hotfix rollups | 14.1.0, 14.0.0, 13.1.1.5 |
698619-2 | 3-Major | BT698619 | Disable port bridging on HSB ports for non-vCMP systems | 14.1.0, 13.1.1.5, 12.1.4 |
681009-1 | 3-Major | BT681009 | Large configurations can cause memory exhaustion during live-install★ | 14.1.0, 13.1.1.5 |
581921-3 | 3-Major | K22327083, BT581921 | Required files under /etc/ssh are not moved during a UCS restore | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.4.1, 11.6.4, 11.5.9 |
697766-1 | 4-Minor | BT697766 | Cisco IOS XR ISIS routers may report 'Authentication TLV not found' | 14.1.0, 13.1.1.5 |
687368-1 | 4-Minor | BT687368 | The Configuration utility may calculate and display an incorrect HA Group Score | 14.0.0, 13.1.1.5 |
686111-1 | 4-Minor | K89363245, BT686111 | Searching and Reseting Audit Logs not working as expected | 14.0.0, 13.1.1.5 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
753912 | 2-Critical | K44385170, BT753912 | UDP flows may not be swept | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
752930-1 | 2-Critical | BT752930 | Changing route-domain on partitions leads to Secondary blade reboot loop and virtual servers left in unusual state | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5, 12.1.5 |
745533-4 | 2-Critical | NodeJS Vulnerability: CVE-2016-5325 | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 | |
680564-1 | 2-Critical | BT680564 | "MCP Message:" seen on boot up with Best License | 14.0.0, 13.1.1.5 |
756270-2 | 3-Major | BT756270 | SSL profile: CRL signature verification does not check for multiple certificates with the same name as the issuer in the trusted CA bundle | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.5, 11.6.4, 11.5.9 |
750843-1 | 3-Major | BT750843 | HTTP data re-ordering when receiving data while iRule parked | 14.0.0.5, 13.1.1.5 |
750200-1 | 3-Major | BT750200 | DHCP requests are not sent to all DHCP servers in the pool when the BIG-IP system is in DHCP Relay mode | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5 |
749689-1 | 3-Major | BT749689 | HTTPS monitor sends different number of cipher suites in client hello after config load and bigd restart | 15.0.0, 14.1.2.3, 13.1.1.5 |
747968-2 | 3-Major | BT747968 | DNS64 stats not increasing when requests go through DNS cache resolver | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.4.1, 11.6.5.3 |
747617-1 | 3-Major | BT747617 | TMM core when processing invalid timer | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5, 12.1.5.2 |
742078-2 | 3-Major | BT742078 | Incoming SYNs are dropped and the connection does not time out. | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1, 11.6.5.1 |
738523-2 | 3-Major | BT738523 | SMTP monitor fails to handle multi-line '250' responses to 'HELO' messages | 14.1.0, 14.0.1.1, 13.1.1.5, 12.1.4.1 |
727292-1 | 3-Major | BT727292 | SSL in proxy shutdown case does not deliver server TCP FIN | 14.1.0, 13.1.1.5, 12.1.5 |
712664-2 | 3-Major | BT712664 | IPv6 NS dropped for hosts on transparent vlangroup with address equal to ARP disabled virtual-address | 14.1.0, 14.0.0.3, 13.1.1.5, 12.1.3.7 |
710564 | 3-Major | BT710564 | DNS returns an erroneous invalidate response with EDNS0 CSUBNET Scope Netmask !=0 | 13.1.1.5, 12.1.4.1 |
709952-1 | 3-Major | BT709952 | Disallow DHCP relay traffic to traverse between route domains | 16.0.0, 13.1.1.5 |
699979-2 | 3-Major | BT699979 | Support for Safenet Client Software v7.x | 14.0.0, 13.1.1.5 |
698437-1 | 3-Major | BT698437 | Internal capacity increase | 14.0.0, 13.1.1.5 |
688553-3 | 3-Major | BT688553 | SASP GWM monitor may not mark member UP as expected | 14.1.0, 14.0.0.5, 13.1.1.5, 12.1.3.6 |
599567-3 | 3-Major | BT599567 | APM assumes SNAT automap, does not use SNAT pool | 15.0.0, 14.1.2.5, 14.0.1.1, 13.1.1.5, 12.1.5 |
746077-1 | 4-Minor | BT746077 | If the 'giaddr' field contains a non-zero value, the 'giaddr' field must not be modified | 15.0.0, 14.1.2.5, 13.1.1.5, 12.1.5.3 |
664618-1 | 4-Minor | BT664618 | Protocol Security HTTP Protocol Check Maximum Number of Headers 'Alarm' mode results in 'Block' | 14.1.0, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
658382-2 | 5-Cosmetic | BT658382 | Large numbers of ERR_UNKNOWN appearing in the logs | 14.1.0, 13.1.1.5, 12.1.4.1 |
Performance Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
735832-1 | 2-Critical | BT735832 | RAM Cache traffic fails on B2150 | 14.1.0, 13.1.1.5, 12.1.5 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
756094-3 | 2-Critical | BT756094 | DNS express in restart loop, 'Error writing scratch database' in ltm log | 15.0.0, 14.1.0.2, 13.1.1.5, 12.1.4.1 |
749508-3 | 3-Major | BT749508 | LDNS and DNSSEC: Various OOM conditions need to be handled properly | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
749222-3 | 3-Major | BT749222 | dname compression offset overflow causes bad compression pointer | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
748902-7 | 3-Major | BT748902 | Incorrect handling of memory allocations while processing DNSSEC queries | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
746877-3 | 3-Major | BT746877 | Omitted check for success of memory allocation for DNSSEC resource record | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
737332-3 | 3-Major | BT737332 | It is possible for DNSX to serve partial zone information for a short period of time | 14.1.0, 13.1.1.5, 12.1.4 |
748177-3 | 4-Minor | BT748177 | Multiple wildcards not matched to most specific WideIP when two wildcard WideIPs differ on a '?' and a non-wildcard character | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.4.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
759360 | 2-Critical | BT759360 | Apply Policy fails due to policy corruption from previously enforced signature | 15.0.0, 14.1.0.6, 13.1.1.5 |
758961 | 2-Critical | K58243048 | During brute force attack, the attempted passwords may be logged | 13.1.1.5 |
723790-1 | 2-Critical | BT723790 | Idle asm_config_server handlers consumes a lot of memory | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.5 |
760878-2 | 3-Major | BT760878 | Incorrect enforcement of explicit global parameters | 15.0.0, 14.1.0.6, 13.1.1.5, 12.1.5 |
755005-3 | 3-Major | BT755005 | Request Log: wrong titles in details for Illegal Request Length and Illegal Query String Length violations | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.5.1 |
754365-3 | 3-Major | BT754365 | Updated flags for countries that changed their flags since 2010 | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
751710-2 | 3-Major | BT751710 | False positive cookie hijacking violation | 15.0.0, 14.1.2.1, 14.0.0.5, 13.1.1.5 |
749109-1 | 3-Major | BT749109 | CSRF situation on BIGIP-ASM GUI | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5 |
746146-2 | 3-Major | BT746146 | AVRD can crash with core when disconnecting/reconnecting on HTTPS connection | 15.0.0, 14.1.0, 13.1.1.5 |
739945-2 | 3-Major | BT739945 | JavaScript challenge on POST with 307 breaks application | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5, 12.1.4 |
738647-2 | 3-Major | BT738647 | Add the login detection criteria of 'status code is not X' | 14.1.0, 14.0.0.5, 13.1.1.5, 12.1.4 |
721399-2 | 3-Major | BT721399 | Signature Set cannot be modified to Accuracy = 'All' after another value | 14.1.0, 13.1.1.5, 12.1.5 |
717525-1 | 3-Major | BT717525 | Behavior for classification in manual learning mode | 14.1.0, 14.0.0.5, 13.1.1.5 |
691945-1 | 3-Major | BT691945 | Security Policy Configuration Changes When Disabling Learning | 14.0.0, 13.1.1.5, 12.1.4.1 |
761921-3 | 4-Minor | BT761921 | avrd high CPU utilization due to perpetual connection attempts | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
758336-1 | 4-Minor | BT758336 | Incorrect recommendation in Online Help of Proactive Bot Defense | 16.1.0, 15.1.2.1, 14.1.4, 13.1.1.5, 12.1.5 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
763349-1 | 2-Critical | BT763349 | AVRD can crash with core when HTTPS connection to BIG-IQ DCD node times out | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
756205-3 | 2-Critical | BT756205 | TMSTAT offbox statistics are not continuous | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
764665-1 | 3-Major | BT764665 | AVRD core when connected to BIG-IQ via HTTPS at the moment of configuration change | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
763005-2 | 3-Major | BT763005 | Aggregated Domain Names in DNS statistics are shown as random domain name | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
760356-4 | 3-Major | BT760356 | Users with Application Security Administrator role cannot delete Scheduled Reports | 15.1.0, 15.0.1.1, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
753446-1 | 3-Major | BT753446 | avrd process crash during shutdown if connected to BIG-IQ | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5 |
738614-2 | 3-Major | BT738614 | 'Internal error' appears on Goodput GUI page | 14.1.0, 14.0.0.5, 13.1.1.5 |
738197-2 | 3-Major | BT738197 | IP address from XFF header is not taken into account when there are trailing spaces after IP address | 15.0.0, 13.1.1.5 |
737863-1 | 3-Major | BT737863 | Advanced Filters for Captured Transactions not working on Multi-Blade Platforms | 14.1.0, 14.0.0.5, 13.1.1.5 |
718655 | 3-Major | BT718655 | DNS profile measurement unit name is incorrect. | 14.1.0, 13.1.1.5 |
700322-2 | 3-Major | BT700322 | Upgrade may fail on a multi blade system when there are scheduled reports in configuration★ | 14.0.0, 13.1.1.5 |
754330-1 | 4-Minor | BT754330 | Monpd might load many CSV files such that stats for AVR are not loaded to the database as quickly as expected | 13.1.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
752592-2 | 2-Critical | BT752592 | VMware Horizon PCoIP clients may fail to connect shortly after logout | 15.0.0, 14.1.0.2, 13.1.1.5 |
704587-2 | 2-Critical | BT704587 | Authentication with UTF-8 chars in password or handling of IP addresses fail due to byte-array processing in iRules | 14.1.0, 14.0.0.5, 13.1.1.5 |
660826-3 | 2-Critical | BT660826 | BIG-IQ Deployment fails with customization-templates | 14.1.0, 14.0.0, 13.1.1.5 |
758764-4 | 3-Major | BT758764 | APMD Core when CRLDP Auth fails to download revoked certificate | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5, 12.1.4.1 |
757992-1 | 3-Major | BT757992 | RADIUS Acct STOP message is not being sent when configured with route domain for HA Pool setup | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
757781-1 | 3-Major | BT757781 | Portal Access: cookie exchange may be broken sometimes | 15.1.0, 15.0.1.1, 14.1.4.2, 14.0.0.5, 13.1.1.5 |
755507-3 | 3-Major | BT755507 | [App Tunnel] 'URI sanitization' error | 15.0.0, 14.0.0.5, 13.1.1.5, 12.1.5 |
755475-3 | 3-Major | BT755475 | Corrupted customization group on target after updating access policy (any agent that is tied to customization group) on source device and config sync | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
749057-3 | 3-Major | BT749057 | VMware Horizon idle timeout is ignored when connecting via APM | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
738430-1 | 3-Major | BT738430 | APM is not able to do compliance check on iOS devices running F5 Access VPN client | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
734291-2 | 3-Major | BT734291 | Logon page modification fails to sync to standby | 14.1.0.6, 14.1.0, 13.1.1.5 |
696835-1 | 3-Major | BT696835 | Secondary Authentication or SSO fail after changing AD or LDAP password | 14.0.0, 13.1.1.5 |
695985-2 | 3-Major | BT695985 | Access HUD filter has URL length limit (4096 bytes) | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.5 |
656784-1 | 3-Major | K98510679, BT656784 | Windows 10 Creators Update breaks RD Gateway functionality in BIG-IP APM | 14.0.0, 13.1.1.5, 12.1.4.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
704555-2 | 2-Critical | BT704555 | Core occurs if DIAMETER::persist reset is called if no persistence key is set. | 14.1.0, 14.0.0.5, 13.1.1.5 |
752822-3 | 3-Major | BT752822 | SIP MRF INGRESS_ALG_TRANSLATION_FAIL state has incorrect state_type | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.5 |
751179-3 | 3-Major | BT751179 | MRF: Race condition may create to many outgoing connections to a peer | 15.0.0, 14.1.0.6, 13.1.1.5, 11.6.5.2 |
749603-3 | 3-Major | BT749603 | MRF SIP ALG: Potential to end wrong call when BYE received | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5 |
748043-3 | 3-Major | BT748043 | MRF SIP ALG with SNAT: SIP Response message not forwarded by BIG-IP | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5 |
747187-3 | 3-Major | BT747187 | SIP falsely detects media flow collision when SDP is in both 183 and 200 response | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5, 12.1.5.2 |
744949-3 | 3-Major | BT744949 | MRF SIP ALG with SNAT may restore incorrect client identity if client IP does not match NAT64 prefix | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
751869 | 2-Critical | BT751869 | Possible tmm crash when using manual mode mitigation in DoS Profile | 15.0.0, 14.1.0.5, 13.1.1.5 |
757279 | 3-Major | BT757279 | LDAP authenticated Firewall Manager role cannot edit firewall policies | 15.1.0.5, 14.1.2.8, 13.1.1.5 |
753893-1 | 3-Major | BT753893 | Inconsistent validation for firewall address-list's nested address-list causes load failure | 15.0.0, 13.1.1.5 |
748081-2 | 3-Major | BT748081 | Memory leak in Behavioral DoS module | 15.0.0, 14.1.0.2, 13.1.1.5 |
710262-1 | 3-Major | BT710262 | Firewall is not updated when adding new rules | 14.1.0, 13.1.1.5 |
Carrier-Grade NAT Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
739272-1 | 3-Major | BT739272 | Incorrect zombie counts in PBA stats with long PBA block-lifetimes | 14.1.0, 13.1.1.5 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
752782-3 | 3-Major | BT752782 | 'DataSafe Profiles' menu has changed to 'BIG-IP DataSafe' | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.5 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
760961 | 2-Critical | BT760961 | TMM crashes due to webroot database shared memory channel corruption when wr_urldbd daemon restarts | 15.0.0, 14.1.4.4, 13.1.1.5 |
757088-3 | 2-Critical | BT757088 | TMM clock advances and cluster failover happens during webroot db nightly updates | 15.0.0, 14.1.0.5, 13.1.1.5, 12.1.5 |
752047-2 | 2-Critical | BT752047 | iRule running reject in CLASSIFICATION_DETECTED event can cause core | 15.0.0, 14.1.0.6, 13.1.1.5 |
761273-1 | 3-Major | BT761273 | wr_urldbd creates sparse log files by writing from the previous position after logrotate. | 15.1.0, 14.1.2.8, 13.1.1.5 |
Device Management Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
761300 | 3-Major | K61105950, BT761300 | Errors in REST token requests may log sensitive data | 13.1.1.5 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
717654-2 | 2-Critical | BT717654 | TMM may crash when flooded to the Virtual Servers with SSL Forward Proxy | 14.1.0, 14.0.0, 13.1.1.5 |
Cumulative fixes from BIG-IP v13.1.1.4 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
744035-4 | CVE-2018-15332 | K12130880, BT744035 | APM Client Vulnerability: CVE-2018-15332 | 14.1.0.2, 14.0.0.5, 13.1.1.4, 12.1.4.1, 11.6.5.1 |
739970-2 | CVE-2018-5390 | K95343321, BT739970 | Linux kernel vulnerability: CVE-2018-5390 | 14.1.0, 14.0.1.1, 13.1.1.4, 12.1.4.1, 11.6.4, 11.5.9 |
738119-2 | CVE-2019-6589 | K23566124, BT738119 | SIP routing UI does not follow best practices | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.3.3 |
745358-3 | CVE-2019-6607 | K14812883, BT745358 | ASM GUI does not follow best practices | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.4, 11.5.9 |
737910-2 | CVE-2019-6609 | K18535734, BT737910 | Security hardening on the following platforms | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4, 12.1.4.1 |
737442-2 | CVE-2019-6591 | K32840424, BT737442 | Error in APM Hosted Content when set to public access | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
658557-3 | CVE-2019-6606 | K35209601, BT658557 | The snmpd daemon may leak memory when processing requests. | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.4 |
530775-3 | CVE-2019-6600 | K23734425 | Login page may generate unexpected HTML output | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.3.3, 11.5.9 |
701785-2 | CVE-2017-18017 | K18352029, BT701785 | Linux kernel vulnerability: CVE-2017-18017 | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.3.3, 11.5.9 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
744685-1 | 2-Critical | BT744685 | BIG-IP does not throw error when intermediate CA is missing the "Basic Constraints" and "CA:True" in its extension | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
744188 | 2-Critical | BT744188 | First successful auth iControl REST requests will now be logged in audit and secure log files | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
748851-1 | 3-Major | BT748851 | Bot Detection injection include tags which may cause faulty display of application | 15.0.0, 13.1.1.4 |
725878-2 | 3-Major | BT725878 | AVR does not collect all of APM TMStats | 14.1.0, 14.0.1.1, 13.1.1.4 |
700827-4 | 3-Major | BT700827 | B2250 blades may lose efficiency when source ports form an arithmetic sequence. | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
667257-4 | 3-Major | BT667257 | CPU Usage Reaches 100% With High FastL4 Traffic | 14.0.0, 13.1.1.4, 12.1.4.1, 11.6.4 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
682837-2 | 1-Blocking | BT682837 | Compression watchdog period too brief. | 14.0.0, 13.1.1.4, 12.1.3.1 |
744331 | 2-Critical | OpenSSH hardening | 14.0.0.5, 13.1.1.4, 12.1.5 | |
743790-3 | 2-Critical | BT743790 | BIG-IP system should trigger a high availability (HA) failover event when expected HSB device is missing from PCI bus | 14.1.0, 13.1.1.4, 12.1.5 |
741423-2 | 2-Critical | BT741423 | Secondary blade goes offline when provisioning ASM/FPS on already established config-sync | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
738887-3 | 2-Critical | BIG-IP SNMPD vulnerability CVE-2019-6608 | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4, 11.6.4 | |
726487-2 | 2-Critical | BT726487 | MCPD on secondary VIPRION or vCMP blades may restart after making a configuration change. | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.4, 12.1.5 |
723298-2 | 2-Critical | BT723298 | BIND upgrade to version 9.11.4 | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4 |
713380 | 2-Critical | K23331143, BT713380 | Multiple B4450 blades in the same chassis run into inconsistent DAG state | 13.1.1.4 |
712738-1 | 2-Critical | BT712738 | fpdd may core dump when the system is going down | 14.1.0, 13.1.1.4 |
710277-1 | 2-Critical | BT710277 | IKEv2 further child_sa validity checks | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.5 |
697424-1 | 2-Critical | BT697424 | iControl-REST crashes on /example for firewall address-lists | 13.1.1.4, 12.1.4 |
688148-3 | 2-Critical | BT688148 | IKEv1 racoon daemon SEGV during phase-two SA list iteration | 14.0.0, 13.1.1.4, 12.1.3.7 |
680556-1 | 2-Critical | BT680556 | Under unknown circumstances sometimes a sessionDB subkey entry becomes corrupted | 14.0.0, 13.1.1.4 |
677937-3 | 2-Critical | K41517253, BT677937 | APM tunnel and IPsec over IPsec tunnel rejects isession-SYN connect packets | 14.0.0, 13.1.1.4, 12.1.3.4 |
668041-2 | 2-Critical | K27535157, BT668041 | Config load fails when an iRule comment ends with backslash in a config where there is also a policy.★ | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
751009-1 | 3-Major | BT751009 | Generating Qkviews or tcpdumps via GUI or running the 'ihealth' command removes /var/tmp/mcpd.out | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
748206 | 3-Major | BT748206 | Browser becomes unresponsive when loading the network map with a virtual server that contains a forwarding rule policy in the second position | 14.1.0.6, 13.1.1.4 |
745809 | 3-Major | BT745809 | The /var partition may become 100% full, requiring manual intervention to clear space | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.4 |
743803-2 | 3-Major | BT743803 | IKEv2 potential double free of object when async request queueing fails | 15.1.0, 14.1.0.6, 14.0.0.3, 13.1.1.4, 12.1.5 |
737536-1 | 3-Major | BT737536 | Enabling 'default-information originate' on one of the several OSPF processes does not inject a default route into others. | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
737437-2 | 3-Major | BT737437 | IKEv1: The 4-byte 'Non-ESP Marker' may be missing in some IKE messages | 14.1.0, 14.0.1.1, 13.1.1.4, 12.1.5 |
737397-3 | 3-Major | BT737397 | User with Certificate Manager role is unable to archive certificates using GUI and iControlSOAP | 14.1.0, 14.0.0.5, 13.1.1.4 |
724143-1 | 3-Major | BT724143 | IKEv2 connflow expiration upon ike-peer change | 14.1.0, 14.0.0.5, 13.1.1.4 |
723579-4 | 3-Major | BT723579 | OSPF routes missing | 14.1.0, 13.1.1.4 |
722691 | 3-Major | BT722691 | Available datagroup list does not contain datagroups with the correct type. | 13.1.1.4 |
721016 | 3-Major | BT721016 | vcmpd fails updating VLAN information on vcmp guest | 14.1.0, 13.1.1.4 |
720110-2 | 3-Major | BT720110 | 0.0.0.0/0 NLRI not sent by BIG-IP when BGP peer resets the session. | 15.0.0, 14.1.0, 13.1.1.4, 12.1.4.1 |
718817-2 | 3-Major | BT718817 | Software installation on secondary blade of VIPRION or VIPRION-based vCMP guest can fail. | 14.1.0, 14.0.0.3, 13.1.1.4 |
718405-1 | 3-Major | BT718405 | RSA signature PAYLOAD_AUTH mismatch with certificates | 15.1.0, 14.1.0.6, 13.1.1.4 |
718397-1 | 3-Major | BT718397 | IKEv2: racoon2 appends spurious trailing null byte to ID payloads | 14.1.0, 14.0.0.5, 13.1.1.4 |
710666-1 | 3-Major | BT710666 | VE with interface(s) marked down may report high cpu usage | 14.1.0, 13.1.1.4 |
706104-3 | 3-Major | BT706104 | Dynamically advertised route may flap | 14.1.0, 13.1.1.4, 12.1.4 |
705442-1 | 3-Major | BT705442 | GUI Network Map objects search on Virtual Server IP Address and Port does not work | 13.1.1.4 |
698947-2 | 3-Major | BT698947 | BIG-IP may incorrectly drop packets from a GRE tunnel with auto-lasthop disabled. | 14.1.0, 13.1.1.4, 12.1.3.6 |
693884-1 | 3-Major | BT693884 | ospfd core on secondary blade during network unstability | 14.0.0, 13.1.1.4, 12.1.4 |
693106-1 | 3-Major | BT693106 | IKEv1 newest established phase-one SAs should be found first in a search | 14.0.0, 13.1.1.4, 12.1.3.6 |
686926-2 | 3-Major | BT686926 | IPsec: responder N(cookie) in SA_INIT response handled incorrectly | 14.0.0, 13.1.1.4, 12.1.3.6 |
686124-1 | 3-Major | K83576240, BT686124 | IPsec: invalid SPI notifications in IKEv1 can cause v1 racoon faults from dangling phase2 SA refs | 14.0.0, 13.1.1.4, 12.1.3.7 |
680838-2 | 3-Major | BT680838 | IKEv2 able to fail assert for GETSPI_DONE when phase-one SA appears not to be initiator | 14.0.0, 13.1.1.4, 12.1.3.6 |
678925-1 | 3-Major | BT678925 | Using a multicast VXLAN tunnel without a proper route may cause a TMM crash. | 14.0.0, 13.1.1.4, 12.1.3.6 |
678380-2 | 3-Major | K26023811, BT678380 | Deleting an IKEv1 peer in current use could SEGV on race conditions. | 14.0.0, 13.1.1.4, 12.1.3.7 |
676897-3 | 3-Major | K25082113, BT676897 | IPsec keeps failing to reconnect | 14.0.0, 13.1.1.4, 12.1.3.6 |
676092-3 | 3-Major | BT676092 | IPsec keeps failing to reconnect | 14.0.0, 13.1.1.4, 12.1.3.6 |
674145-1 | 3-Major | BT674145 | chmand error log message missing data | 14.0.0, 13.1.1.4, 12.1.4, 11.6.3.3, 11.5.9 |
670197-1 | 3-Major | BT670197 | IPsec: ASSERT 'BIG-IP_conn tag' failed | 14.0.0, 13.1.1.4 |
652502-2 | 3-Major | BT652502 | SNMP queries return 'No Such Object available' error for LTM OIDs | 15.0.0, 14.1.3.1, 13.1.1.4 |
639619-5 | 3-Major | BT639619 | UCS may fail to load due to Master key decryption failure on EEPROM-less systems★ | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4, 12.1.4.1, 11.6.4 |
598085-1 | 3-Major | BT598085 | Expected telemetry is not transmitted by sFlow on the standby-mode unit. | 14.0.0, 13.1.1.4, 12.1.4 |
491560-2 | 3-Major | BT491560 | Using proxy for IP intelligence updates | 14.0.0, 13.1.1.4, 12.1.4 |
738985-2 | 4-Minor | BIND vulnerability: CVE-2018-5740 | 14.1.0, 14.0.0.3, 13.1.1.4 | |
689491 | 4-Minor | BT689491 | cpu usage reported as 'stolen' on vcmp guests with 1-core or htsplit disabled | 14.1.0, 13.1.1.4 |
689211-3 | 4-Minor | BT689211 | IPsec: IKEv1 forwards IPv4 packets incorrectly as IPv6 to daemon after version was { v1 v2 } | 14.0.0, 13.1.1.4, 12.1.3.7 |
680856-2 | 4-Minor | BT680856 | IPsec config via REST scripts may require post-definition touch of both policy and traffic selector | 14.0.0, 13.1.1.4, 12.1.3.6 |
713491-2 | 5-Cosmetic | BT713491 | IKEv1 logging shows spi of deleted SA with opposite endianess | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.3.6 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
744269-2 | 2-Critical | BT744269 | dynconfd restarts if FQDN template node deleted while IP address change in progress | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4.1 |
744117-5 | 2-Critical | K18263026, BT744117 | The HTTP URI is not always parsed correctly | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
743857 | 2-Critical | K21942600, BT743857 | Clientssl accepts non-SSL traffic when cipher-group is configured | 13.1.1.4 |
742627-2 | 2-Critical | BT742627 | SSL session mirroring may cause memory leakage if HA channel is down | 14.1.0, 14.0.0.5, 13.1.1.4 |
741919 | 2-Critical | BT741919 | HTTP response may be dropped following a 100 continue message. | 14.0.0.5, 13.1.1.4, 12.1.4.1 |
740963-2 | 2-Critical | BT740963 | VIP-targeting-VIP traffic can cause TCP retransmit bursts resulting in tmm restart | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.5 |
740490-1 | 2-Critical | BT740490 | Configuration changes involving HTTP2 or SPDY may leak memory | 14.0.0.5, 13.1.1.4, 12.1.4 |
739003-1 | 2-Critical | BT739003 | TMM may crash when FastL4 is used on ePVA-capable BIG-IP platforms | 14.1.0, 13.1.1.4 |
738945-2 | 2-Critical | BT738945 | SSL persistence does not work when there are multiple handshakes present in a single record | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4, 12.1.4.1 |
738046-2 | 2-Critical | BT738046 | SERVER_CONNECTED fires at wrong time for FastL4 mirrored connections on standby | 14.1.0, 13.1.1.4, 12.1.5 |
737758-2 | 2-Critical | BT737758 | MPTCP Passthrough and VIP-on-VIP can lead to TMM core | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4 |
734276-2 | 2-Critical | BT734276 | TMM may leak memory when SSL certificates with VDI or EAM in use | 14.1.0, 13.1.1.4 |
727206 | 2-Critical | BT727206 | Memory corruption when using SSL Forward Proxy on certain platforms | 14.0.0.5, 13.1.1.4, 12.1.4.1 |
720136-1 | 2-Critical | BT720136 | Upgrade may fail on mcpd when external netHSM is used | 14.1.0, 13.1.1.4 |
718210-2 | 2-Critical | BT718210 | Connections using virtual targeting virtual and time-wait recycle result in a connection being improperly reused | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4.1 |
716714-1 | 2-Critical | BT716714 | OCSP should be configured to avoid TMM crash. | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
702792-1 | 2-Critical | K82327396, BT702792 | Upgrade creates Server SSL profiles with invalid cipher strings★ | 14.0.0, 13.1.1.4 |
685254-2 | 2-Critical | K14013100, BT685254 | RAM Cache Exceeding Watchdog Timeout in Header Field Search | 14.0.0, 13.1.1.4, 12.1.3.4 |
513310-5 | 2-Critical | BT513310 | TMM might core when a profile is changed. | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.3.7, 11.6.4, 11.5.9 |
849861 | 3-Major | BT849861 | TMM may crash with FastL4 and HTTP profile using fallback host and iRule command | 13.1.1.4 |
752078 | 3-Major | BT752078 | Header Field Value String Corruption | 15.0.0, 14.1.0.6, 13.1.1.4 |
739963-2 | 3-Major | BT739963 | TLS v1.0 fallback can be triggered intermittently and fail with restrictive server setup | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4, 12.1.5 |
739379-2 | 3-Major | BT739379 | Multi-layered SSL forward proxy deployed within single BIG-IP may trigger random certificate verification error | 14.1.0, 14.0.0.5, 13.1.1.4 |
739349-1 | 3-Major | BT739349 | LRO segments might be erroneously VLAN-tagged. | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
738521-1 | 3-Major | BT738521 | i4x00/i2x00 platforms transmit LACP PDUs with a VLAN Tag. | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
726319-2 | 3-Major | BT726319 | 'The requested Pool Member ... already exists' logged when FQDN resolves to different IP addresses | 14.1.0, 14.0.0.3, 13.1.1.4 |
724564-1 | 3-Major | BT724564 | A FastL4 connection can fail with loose-init and hash persistence enabled | 14.1.0, 13.1.1.4 |
724327-1 | 3-Major | BT724327 | Changes to a cipher rule do not immediately have an effect | 15.0.0, 14.1.0.2, 13.1.1.4 |
721621-1 | 3-Major | BT721621 | Ephemeral pool member is not created/deleted when DNS record changes and IP matches static node | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4.1 |
720799-2 | 3-Major | BT720799 | Virtual Server/VIP flaps with FQDN pool members when all IP addresses change | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4.1 |
717896-2 | 3-Major | BT717896 | Monitor instances deleted in peer unit after sync | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4, 12.1.4.1 |
717100-3 | 3-Major | BT717100 | FQDN pool member is not added if FQDN resolves to same IP address as another existing FQDN pool member | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4, 12.1.4.1 |
716716-2 | 3-Major | BT716716 | Under certain circumstances, having a kernel route but no TMM route can lead to a TMM core | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4.1 |
714559-2 | 3-Major | BT714559 | Removal of HTTP hash persistence cookie when a pool member goes down. | 14.1.0, 13.1.1.4, 12.1.4 |
713690-3 | 3-Major | BT713690 | IPv6 cache route metrics are locked | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.3.7 |
711981-5 | 3-Major | BT711981 | BIG-IP system accepts larger-than-egress MTU, PMTU update | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.3.7, 11.6.5.3 |
710028-2 | 3-Major | BT710028 | LTM SQL monitors may stop monitoring if multiple monitors querying same database | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4, 11.6.3.3, 11.5.9 |
708068-2 | 3-Major | BT708068 | Tcl commands like "HTTP::path -normalize" do not return normalized path. | 15.0.0, 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
707691-4 | 3-Major | BT707691 | BIG-IP handles some pathmtu messages incorrectly | 14.1.0, 14.0.0.5, 13.1.1.4 |
706102-2 | 3-Major | BT706102 | SMTP monitor does not handle all multi-line banner use cases | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.4 |
701678-2 | 3-Major | BT701678 | Non-TCP and non-FastL4 virtual server with rate-limits may periodically stop sending packets to server when rate exceeded | 14.0.0, 13.1.1.4, 12.1.4 |
685519-1 | 3-Major | BT685519 | Mirrored connections ignore the handshake timeout | 14.0.0, 13.1.1.4, 12.1.4.1, 11.6.4 |
683697-1 | 3-Major | K00647240, BT683697 | SASP monitor may use the same UID for multiple HA device group members | 14.0.0, 13.1.1.4, 12.1.3.4 |
674591-3 | 3-Major | K37975308, BT674591 | Packets with payload smaller than MSS are being marked to be TSOed | 14.1.0, 13.1.1.4, 12.1.4, 11.6.5.2 |
504522-1 | 3-Major | BT504522 | Trailing space present after 'tmsh ltm pool members monitor' attribute value | 15.0.0, 14.1.0.6, 14.0.1.1, 13.1.1.4, 12.1.5 |
719247-2 | 4-Minor | K10845686, BT719247 | HTTP::path and HTTP::query iRule functions cannot be set to a blank string | 14.1.0, 14.0.0.5, 13.1.1.4 |
618884-6 | 4-Minor | BT618884 | Behavior when using VLAN-Group and STP | 14.1.0, 13.1.1.4, 12.1.4 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
739846-3 | 2-Critical | BT739846 | Potential Big3D segmentation fault when not enough memory to establish a new iQuery Connection | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.4.1, 11.6.4, 11.5.9 |
749774-3 | 3-Major | BT749774 | EDNS0 client subnet behavior inconsistent when DNS Caching is enabled | 15.0.0, 14.1.0.1, 14.0.0.4, 13.1.1.4, 12.1.4, 11.6.3.4, 11.5.8 |
749675-3 | 3-Major | BT749675 | DNS cache resolver may return a malformed truncated response with multiple OPT records | 15.0.0, 14.1.0.1, 14.0.0.4, 13.1.1.4, 12.1.4, 11.6.3.4, 11.5.8 |
744707-4 | 3-Major | BT744707 | Crash related to DNSSEC key rollover | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.4, 12.1.4.1 |
726255-2 | 3-Major | BT726255 | dns_path lingering in memory with last_access 0 causing high memory usage | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.3.7, 11.6.5.1, 11.5.9 |
723288-2 | 3-Major | BT723288 | DNS cache replication between TMMs does not always work for net dns-resolver | 14.1.0.6, 14.0.0.5, 13.1.1.4, 12.1.4.1, 11.6.5.3 |
710246-2 | 3-Major | BT710246 | DNS-Express was not sending out NOTIFY messages on VE | 14.1.0, 14.0.0.3, 13.1.1.4, 12.1.3.7 |
702457-2 | 3-Major | BT702457 | DNS Cache connections remain open indefinitely | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.5.3 |
717113-2 | 4-Minor | BT717113 | It is possible to add the same GSLB Pool monitor multiple times | 14.1.0, 13.1.1.4 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
750922-3 | 2-Critical | BT750922 | BD crash when content profile used for login page has no parse parameters set | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
726537-1 | 2-Critical | BT726537 | Rare TMM crash when Single Page Application is enabled on DoSL7 | 14.0.0, 13.1.1.4 |
576123-4 | 2-Critical | K23221623, BT576123 | ASM policies are created as inactive policies on the peer device | 14.0.0, 13.1.1.4, 12.1.3.2, 11.6.3.2, 11.5.9 |
750356-3 | 3-Major | BT750356 | Split View pages: if user-defined filter removed right after creation - all user-defined filters are deleted | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
747777-1 | 3-Major | BT747777 | Extractions are learned in manual learning mode | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
747550-1 | 3-Major | BT747550 | Error 'This Logout URL already exists!' when updating logout page via GUI | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
745802-3 | 3-Major | BT745802 | Brute Force CAPTCHA response page truncates last digit in the support id | 15.0.0, 14.1.2.1, 14.0.0.5, 13.1.1.4 |
744347-2 | 3-Major | BT744347 | Protocol Security logging profiles cause slow ASM upgrade and apply policy | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4, 12.1.4 |
743961-3 | 3-Major | BT743961 | Signature Overrides for Content Profiles do not work after signature update | 15.0.0, 14.1.0, 14.0.0.5, 13.1.1.4 |
738864-1 | 3-Major | BT738864 | javascript functions in href are learned from response as new URLs | 14.1.0, 14.0.0.5, 13.1.1.4 |
738211-3 | 3-Major | BT738211 | pabnagd core when centralized learning is turned on | 14.1.0, 14.0.0.5, 13.1.1.4 |
734228-1 | 3-Major | BT734228 | False-positive illegal-length violation can appear | 14.1.2.3, 14.0.1.1, 13.1.1.4 |
726377-1 | 3-Major | BT726377 | False-positive cookie hijacking violation | 13.1.1.4 |
721752-2 | 3-Major | BT721752 | Null char returned in REST for Suggestion with more than MAX_INT occurrences | 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.3.7 |
705925-1 | 3-Major | BT705925 | Websocket Message Type not displayed in Request Log | 14.0.0, 13.1.1.4 |
701792-2 | 3-Major | BT701792 | JS Injection into cached HTML response causes TCP RST on the fictive URLs | 14.0.0, 13.1.1.4 |
696333-1 | 3-Major | BT696333 | Threat campaign filter does not return campaign if filter contains quotation marks | 14.0.0, 13.1.1.4 |
690215-2 | 3-Major | BT690215 | Missing requests in request log | 14.0.0, 13.1.1.4, 12.1.4.1 |
676416-4 | 3-Major | BT676416 | BD restart when switching FTP profiles | 14.0.0, 13.1.1.4, 12.1.3.2, 11.6.3.2 |
676223-4 | 3-Major | BT676223 | Internal parameter in order not to sign allowed cookies | 14.0.0, 13.1.1.4, 12.1.3.7 |
663535-2 | 3-Major | BT663535 | Sending ASM cookies with "secure" attribute even without client-ssl profile | 14.0.0, 13.1.1.4, 12.1.3.2 |
605649-2 | 3-Major | K28782793, BT605649 | The cbrd daemon runs at 100% CPU utilization | 14.0.0, 13.1.1.4, 12.1.5 |
748999-1 | 4-Minor | BT748999 | invalid inactivity timeout suggestion for cookies | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
747905-1 | 4-Minor | BT747905 | 'Illegal Query String Length' violation displays wrong length | 15.0.0, 14.1.5.1, 14.0.1.1, 13.1.1.4 |
745531-1 | 4-Minor | BT745531 | Puffin Browser gets blocked by Bot Defense | 15.0.0, 14.1.0.2, 13.1.1.4 |
739345 | 4-Minor | BT739345 | Reporting invalid signature id after specific signature upgrade | 13.1.1.4 |
685743-5 | 4-Minor | BT685743 | When changing internal parameter 'request_buffer_size' in large request violations might not be reported | 14.0.0, 13.1.1.4, 12.1.3.2 |
665470-3 | 4-Minor | BT665470 | Failed to load sample requests on the Traffic Learning page with VIOL_MALICIOUS_IP viol is raised | 14.0.0, 13.1.1.4, 12.1.3.6 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
746941 | 2-Critical | BT746941 | Memory leak in avrd when BIG-IQ fails to receive stats information | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
739446-2 | 2-Critical | BT739446 | Resetting SSL-socket correctly for AVR connection | 14.1.0, 13.1.1.4 |
737813-1 | 2-Critical | BT737813 | BIG-IP is unable to send statistics to BIG-IQ DCD node using IPv6 address | 14.1.0, 14.0.0.5, 13.1.1.4 |
749464 | 3-Major | BT749464 | Race condition while BIG-IQ updates common file | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
749461 | 3-Major | BT749461 | Race condition while modifying analytics global-settings | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
746823 | 3-Major | BT746823 | AVRD crash when configured to send data externally, and there are large number of virtuals/pool-members | 15.0.0, 14.1.0, 14.0.0.5, 13.1.1.4 |
745027 | 3-Major | BT745027 | AVR is doing extra activity of DNS data collection even when it should not | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
744595-1 | 3-Major | BT744595 | DoS-related reports might not contain some of the activity that took place | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
744589-1 | 3-Major | BT744589 | Missing data for Firewall Events Statistics | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
741767-2 | 3-Major | BT741767 | ASM Resource :: CPU Utilization statistics are in wrong scale | 14.1.0, 14.0.1.1, 13.1.1.4 |
740086 | 3-Major | BT740086 | AVR report ignore partitions for Admin users | 14.1.0, 14.0.0.5, 13.1.1.4 |
716782-2 | 3-Major | BT716782 | AVR should add new field to the events it sends: Microtimestamp | 14.1.0, 14.0.0, 13.1.1.4 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
753368 | 1-Blocking | BT753368 | Unable to import access policy with pool | 13.1.1.4 |
747621-2 | 2-Critical | BT747621 | Native VMware Horizon client fails to authenticate against APM if RADIUS challenge is used | 14.1.0, 14.0.0.5, 13.1.1.4 |
744556-1 | 2-Critical | K01226413, BT744556 | Upgrade PingAccess SDK used by BIG-IP APM to v1.1.3 | 14.1.0, 13.1.1.4 |
714716-2 | 2-Critical | K10248311, BT714716 | Apmd logs password for acp messages when in debug mode | 14.0.0, 13.1.1.4, 12.1.4.1, 11.6.3.2 |
754346-1 | 3-Major | BT754346 | Access policy was not found while creating configuration snapshot. | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
750496-1 | 3-Major | BT750496 | TMM crashes on traffic passthrough when SSO Config object is deleted while being used in SSO Configuration Select Agent in PRP | 14.0.0.5, 13.1.1.4 |
746771-1 | 3-Major | BT746771 | APMD recreates config snapshots for all access profiles every minute | 15.0.0, 14.1.0.2, 13.1.1.4 |
746768-1 | 3-Major | BT746768 | APMD leaks memory if access policy policy contains variable/resource assign policy items | 15.0.0, 14.1.2.1, 13.1.1.4, 12.1.4.1 |
745654-2 | 3-Major | BT745654 | Heavy use of APM Kerberos SSO can sometimes lead to slowness of Virtual Server | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4, 12.1.4.1 |
745574-3 | 3-Major | BT745574 | URL is not removed from custom category when deleted | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.4, 12.1.4 |
743437-1 | 3-Major | BT743437 | Portal Access: Issue with long 'data:' URL | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
743150-1 | 3-Major | BT743150 | Increase the limit of the maximum allowed timestamp for OAuth token processing for OAuth Client | 15.0.0, 13.1.1.4 |
739744-1 | 3-Major | BT739744 | Import of Policy using Pool with members is failing | 14.1.0, 13.1.1.4, 12.1.4 |
719079-1 | 3-Major | BT719079 | Portal Access: same-origin AJAX request may fail under some conditions. | 14.1.0, 13.1.1.4 |
718136-2 | 3-Major | BT718136 | 32-bit F5 VPN and Endpoint Inspector apps are discontinued on Linux | 14.1.0, 14.0.0, 13.1.1.4 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
742829-3 | 3-Major | BT742829 | SIP ALG: Do not translate and create media channels if RTP port is defined in the SIP message is 0 | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.4 |
741951-2 | 3-Major | BT741951 | Multiple extensions in SIP NOTIFY request cause message to be dropped. | 15.0.0, 14.1.0, 14.0.0.5, 13.1.1.4, 12.1.5.2, 11.6.5.2 |
699431-3 | 3-Major | BT699431 | Possible memory leak in MRF under low memory | 14.1.0, 14.0.0, 13.1.1.4, 12.1.3.2 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
747104-3 | 1-Blocking | K52868493, BT747104 | LibSSH: CVE-2018-10933 | 15.0.0, 14.1.0.2, 13.1.1.4, 12.1.4.1 |
753028-1 | 3-Major | BT753028 | AFM drops forwarding ICMP traffic matching FW NAT rule for Dest NAT that also has Proxy ARP enabled for destination addresses in the rule | 15.0.0, 14.1.0.6, 13.1.1.4 |
747926 | 3-Major | BT747926 | Rare TMM restart due to NULL pointer access during AFM ACL logging | 15.0.0, 14.1.0.2, 13.1.1.4 |
Carrier-Grade NAT Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
744516-1 | 2-Critical | BT744516 | TMM panics after a large number of LSN remote picks | 15.0.0, 14.1.0.6, 13.1.1.4, 12.1.4 |
744959-1 | 3-Major | BT744959 | SNMP OID for sysLsnPoolStatTotal not incremented in stats | 15.0.0, 13.1.1.4, 12.1.4.1 |
727212-1 | 3-Major | BT727212 | Subscriber-id query using full length IPv6 address fails. | 14.1.0, 14.0.0.5, 13.1.1.4 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
748976 | 3-Major | BT748976 | DataSafe Logging Settings page is missing when DataSafe license is active | 13.1.1.4 |
742037-3 | 3-Major | BT742037 | FPS live updates do not install when minor version is different | 14.1.0, 14.0.0.5, 13.1.1.4 |
741449-1 | 4-Minor | BT741449 | alert_details is missing for COMPONENT_VALIDATION_JAVASCRIPT_THRESHOLD alerts | 15.0.0, 14.1.0.2, 14.0.0.5, 13.1.1.4 |
726039 | 5-Cosmetic | BT726039 | Information is not updated after installing FPS live update via GUI | 13.1.1.4 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
748813-1 | 2-Critical | BT748813 | tmm cores under stress test on virtual server with DoS profile with admd enabled | 15.0.0, 14.1.2.3, 14.0.0.5, 13.1.1.4 |
748121-1 | 2-Critical | BT748121 | admd livelock under CPU starvation | 15.0.0, 14.1.0.6, 14.0.0.5, 13.1.1.4 |
741761-1 | 2-Critical | BT741761 | admd might fail the heartbeat, resulting in a core | 14.1.0, 14.0.0.5, 13.1.1.4 |
704236-1 | 2-Critical | BT704236 | TMM crash when attaching FastL4 profile | 14.0.0, 13.1.1.4 |
702936-1 | 2-Critical | BT702936 | TMM SIGSEGV under specific conditions. | 14.0.0, 13.1.1.4 |
653573-4 | 2-Critical | BT653573 | ADMd not cleaning up child rsync processes | 15.0.0, 14.1.2.3, 14.1.0.6, 14.0.0.5, 13.1.1.4, 13.1.0 |
741993-1 | 3-Major | BT741993 | The BIG-IP system does not answer the request matching L7 policy that disabled DOSL7 when BADOS configured. | 14.1.0, 14.0.0.5, 13.1.1.4 |
741752-1 | 3-Major | BT741752 | [BADOS] state file is not saved when virtual server reuses a self IP of the device | 14.1.0, 13.1.1.4 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
724847 | 3-Major | K95010813, BT724847 | DNS traffic does not get classified for AFM port misuse case | 14.1.0, 14.0.0, 13.1.1.4 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
740969-1 | 1-Blocking | K65151021, BT740969 | Menu visibility issue with newly activated license.★ | 13.1.1.4, 12.1.4.1 |
706339-1 | 2-Critical | K30392060, BT706339 | TMM crashes due to memory leaking while processing SSL forward proxy traffic | 14.0.0, 13.1.1.4 |
Cumulative fixes from BIG-IP v13.1.1.3 that are included in this release
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
745783-3 | 3-Major | BT745783 | Anti-fraud: remote logging of login attempts | 15.0.0, 14.1.0.3, 13.1.1.3 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
684370-1 | 3-Major | BT684370 | APM now supports VMware Workspace ONE integration with VIDM as ID Provider | 14.0.0, 13.1.1.3 |
683741-1 | 3-Major | BT683741 | APM now supports VMware Workspace ONE integration with vIDM as ID Provider | 14.0.0, 13.1.1.3 |
635509-1 | 3-Major | BT635509 | APM does not support Vmware'e Blast UDP | 14.0.0, 13.1.1.3 |
Cumulative fixes from BIG-IP v13.1.1.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
739947-1 | CVE-2019-6610 | K42465020, BT739947 | TMM may crash while processing APM traffic | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.4.1, 11.6.4, 11.5.9 |
737443-5 | CVE-2018-5546 | K54431371, BT737443 | BIG-IP APM client for Linux and macOS vulnerability CVE-2018-5546 | 14.0.0.5, 13.1.1.2 |
737441-5 | CVE-2018-5546 | K54431371, BT737441 | Disallow hard links to svpn log files | 14.0.0.5, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.9 |
726089-2 | CVE-2018-15312 | K44462254, BT726089 | Modifications to AVR metrics page | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.7 |
725815-1 | CVE-2018-15320 | K72442354, BT725815 | vlangroup usage may cause a excessive resource consumption | 14.1.0, 14.0.0.3, 13.1.1.2 |
724339-1 | CVE-2018-15314 | K04524282, BT724339 | Unexpected TMUI output in AFM | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.7 |
724335-1 | CVE-2018-15313 | K21042153, BT724335 | Unexpected TMUI output in AFM | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.7 |
722677-4 | CVE-2019-6604 | K26455071, BT722677 | BIG-IP HSB vulnerability CVE-2019-6604 | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.4, 11.5.9 |
722387-3 | CVE-2019-6596 | K97241515, BT722387 | TMM may crash when processing APM DTLS traffic | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.9 |
722091-3 | CVE-2018-15319 | K64208870, BT722091 | TMM may crash while processing HTTP traffic | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
717888 | CVE-2018-15323 | K26583415, BT717888 | TMM may leak memory when a virtual server uses the MQTT profile. | 14.1.0, 14.0.0.3, 13.1.1.2 |
717742-5 | CVE-2018-2798, CVE-2018-2811, CVE-2018-2795, CVE-2018-2790, CVE-2018-2783, CVE-2018-2825, CVE-2018-2826, CVE-2018-2796, CVE-2018-2799, CVE-2018-2815, CVE-2018-2800, CVE-2018-2814, CVE-2018-2797, CVE-2018-2794 | K44923228, BT717742 | Oracle Java SE vulnerability CVE-2018-2783 | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
707990-2 | CVE-2018-15315 | K41704442, BT707990 | Unexpected TMUI output in SSL Certificate Instance page | 14.0.0, 13.1.1.2, 12.1.3.7 |
704184-6 | CVE-2018-5529 | K52171282, BT704184 | APM MAC Client create files with owner only read write permissions | 14.0.0.5, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.9 |
701253-5 | CVE-2018-15318 | K16248201, BT701253 | TMM core when using MPTCP | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3 |
693810-6 | CVE-2018-5529 | K52171282, BT693810 | CVE-2018-5529: APM Linux Client Vulnerability | 14.0.0.5, 13.1.1.2, 11.6.3.3, 11.5.9 |
741858-1 | CVE-2018-15324 | K52206731, BT741858 | TMM may crash while processing Portal Access requests | 14.1.0, 14.0.0.5, 13.1.1.2 |
734822-3 | CVE-2018-15325 | K77313277, BT734822 | TMSH improvements | 14.1.0, 14.0.0.3, 13.1.1.2 |
725801-4 | CVE-2017-7889 | K80440915, BT725801 | CVE-2017-7889: Kernel Vulnerability | 14.1.0, 14.0.0.3, 13.1.1.2 |
725635-2 | CVE-2018-3665 | K21344224, BT725635 | CVE-2018-3665: Intel Lazy FPU Vulnerability | 14.1.0, 14.0.0.3, 13.1.1.2 |
724680-4 | CVE-2018-0732 | K21665601, BT724680 | OpenSSL Vulnerability: CVE-2018-0732 | 15.0.0, 14.1.0.2, 14.0.1.1, 13.1.1.2, 12.1.4, 11.6.3.3, 11.5.9 |
721924-2 | CVE-2018-17539 | K17264695, BT721924 | BIG-IP ARM BGP vulnerability CVE-2018-17539 | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.9 |
719554-2 | CVE-2018-8897 | K17403481, BT719554 | Linux Kernel Vulnerability: CVE-2018-8897 | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.9 |
716900-2 | CVE-2019-6594 | K91026261, BT716900 | TMM core when using MPTCP | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4, 11.6.3.3 |
710705-2 | CVE-2018-7320, CVE-2018-7321, CVE-2018-7322, CVE-2018-7423, CVE-2018-7324, CVE-2018-7325, CVE-2018-7326, CVE-2018-7327, CVE-2018-7428, CVE-2018-7329, CVE-2018-7330, CVE-2018-7331, CVE-2018-7332, CVE-2018-7333, CVE-2018-7334, CVE-2018-7335, CVE-2018-7336, CVE-2018-7337, CVE-2018-7417, CVE-2018-7418, CVE-2018-7419, CVE-2018-7420, CVE-2018-7421 | K34035645, BT710705 | Multiple Wireshark vulnerabilities | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.6 |
705799-2 | CVE-2018-15325 | K77313277, BT705799 | TMSH improvements | 14.1.0, 14.0.0, 13.1.1.2 |
699453-4 | CVE-2018-15327 | K20222812, BT699453 | Web UI does not follow current best coding practices | 14.1.0, 14.0.0.3, 13.1.1.2 |
699452-4 | CVE-2019-6597 | K29280193 | Web UI does not follow current best coding practices | 13.1.1.2, 12.1.4, 11.6.3.3, 11.5.9 |
712876-2 | CVE-2017-8824 | K15526101, BT712876 | CVE-2017-8824: Kernel Vulnerability | 14.1.0, 14.0.1.1, 13.1.1.2, 12.1.5.1, 11.6.5.1 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
734527-1 | 3-Major | BT734527 | BGP 'capability graceful-restart' for peer-group not properly advertised when configured | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4, 11.6.5.1 |
715750-2 | 3-Major | K41515225, BT715750 | The BIG-IP system may exhibit undesirable behaviors when receiving a FIN midstream an SSL connection. | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.5.1 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
693611-3 | 1-Blocking | K76313256, BT693611 | IKEv2 ike-peer might crash on stats object during peer modification update | 14.0.0, 13.1.1.2 |
743810-1 | 2-Critical | BT743810 | AWS: Disk resizing in m5/c5 instances fails silently. | 14.1.0, 13.1.1.2 |
743082-1 | 2-Critical | BT743082 | Upgrades to 13.1.1.2, 14.0.0, 14.0.0.1, or 14.0.0.2 from pre-12.1.3 can cause configurations to fail with GTM Pool Members★ | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.5.2 |
739507 | 2-Critical | BT739507 | Improved recovery method for BIG-IP system that has halted from a failed FIPS integrity check | 16.1.0, 15.1.0.5, 14.1.4, 13.1.1.2 |
739505 | 2-Critical | BT739505 | Automatic ISO digital signature checking not required when FIPS license active★ | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.1.2 |
739285-1 | 2-Critical | BT739285 | GUI partially missing when VCMP is provisioned | 14.1.0, 13.1.1.2 |
725696-1 | 2-Critical | BT725696 | A timer loop might occur when OCSP Stapling is enabled resulting in tmm getting aborted | 14.1.0, 14.0.0.3, 13.1.1.2 |
723722-2 | 2-Critical | BT723722 | MCPD crashes if several thousand files are created between config syncs. | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
721350-2 | 2-Critical | BT721350 | The size of the icrd_child process is steadily growing | 14.1.0, 13.1.1.2 |
717785-1 | 2-Critical | BT717785 | Interface-cos shows no egress stats for CoS configurations | 14.1.0, 13.1.1.2 |
716391-2 | 2-Critical | K76031538, BT716391 | High priority for MySQL on 2 core vCMP may lead to control plane process starvation | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.3.7, 11.6.4, 11.5.9 |
711683-2 | 2-Critical | BT711683 | bcm56xxd crash with empty trunk in QinQ VLAN | 14.1.0, 13.1.1.2 |
707003-3 | 2-Critical | BT707003 | Unexpected syntax error in TMSH AVR | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.6 |
706423-1 | 2-Critical | BT706423 | tmm may restart if an IKEv2 child SA expires during an async encryption or decryption | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.6 |
703669-2 | 2-Critical | BT703669 | Eventd restarts on NULL pointer access | 14.1.0, 14.0.0.3, 13.1.1.2 |
703045-1 | 2-Critical | BT703045 | If using TMSH commands with deprecated attributes in iApp, the upgrade will fail. | 14.1.0, 14.0.0.3, 13.1.1.2 |
700386-2 | 2-Critical | BT700386 | mcpd may dump core on startup | 14.0.0, 13.1.1.2, 12.1.4 |
693996-5 | 2-Critical | K42285625, BT693996 | MCPD sync errors and restart after multiple modifications to file object in chassis | 14.0.0, 13.1.1.2, 12.1.5, 11.6.5.1, 11.5.9 |
692158-1 | 2-Critical | BT692158 | iCall and CLI script memory leak when saving configuration | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.6 |
691589-4 | 2-Critical | BT691589 | When using LDAP client auth, tamd may become stuck | 14.0.0, 13.1.1.2, 12.1.4 |
690819-1 | 2-Critical | BT690819 | Using an iRule module after a 'session lookup' may result in crash | 14.0.0, 13.1.1.2, 12.1.3.6, 11.6.3.3 |
689437-1 | 2-Critical | K49554067, BT689437 | icrd_child cores due to infinite recursion caused by incorrect group name handling | 14.0.0, 13.1.1.2, 12.1.4, 11.6.4, 11.5.9 |
689002-3 | 2-Critical | BT689002 | Stackoverflow when JSON is deeply nested | 14.0.0, 13.1.1.2, 12.1.4 |
658410-2 | 2-Critical | BT658410 | icrd_child generates a core when calling PUT on ltm/data-group/internal/ | 14.0.0, 13.1.1.2 |
652877-5 | 2-Critical | BT652877 | Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades | 14.0.0, 13.1.1.2, 12.1.4, 11.6.4, 11.5.9 |
638091-6 | 2-Critical | BT638091 | Config sync after changing named pool members can cause mcpd on secondary blades to restart | 14.0.0, 13.1.1.2, 12.1.4 |
739126 | 3-Major | BT739126 | Multiple VE installations may have different sized volumes | 14.1.0, 13.1.1.2 |
733585-3 | 3-Major | BT733585 | Merged can use %100 of CPU if all stats snapshot files are in the future | 14.1.0, 13.1.1.2 |
727467-1 | 3-Major | BT727467 | Some iSeries appliances can experience traffic disruption when the high availability (HA) peer is upgraded from 12.1.3 and earlier to 13.1.0 or later. | 14.1.0, 14.0.0.5, 13.1.1.2 |
726409-4 | 3-Major | Kernel Vulnerabilities: CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4.1, 11.6.4, 11.5.9 | |
722682-2 | 3-Major | BT722682 | Fix of ID 615222 results in upgrade issue for GTM pool member whose name contains a colon; config failed to load★ | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4.1 |
721740-2 | 3-Major | BT721740 | CPU stats are not correctly recorded when snapshot files have timestamps in the future | 14.1.0, 13.1.1.2 |
720713-2 | 3-Major | BT720713 | TMM traffic to/from a i5800/i7800/i10800 device in vCMP host mode may fail | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
720461-2 | 3-Major | BT720461 | qkview prompts for password on chassis | 14.1.0, 13.1.1.2, 12.1.4 |
718525-1 | 3-Major | BT718525 | PostGreSQL errors seen on startup after removing the mcpd binary database and rebooting | 14.1.0, 14.0.0.3, 13.1.1.2 |
714974-2 | 3-Major | BT714974 | Platform-migrate of UCS containing QinQ fails on VE★ | 14.1.0, 13.1.1.2 |
714903-2 | 3-Major | BT714903 | Errors in chmand | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.4.1 |
714654-2 | 3-Major | BT714654 | Creating static route for advertised dynamic route might result in dropping the tmrouted connection to TMM | 14.1.0, 13.1.1.2, 12.1.4.1 |
713813-2 | 3-Major | BT713813 | Node monitor instances not showing up in GUI | 13.1.1.2 |
712102-2 | 3-Major | K11430165, BT712102 | customizing or changing the HTTP Profile's IPv6 field hides the field or the row | 14.1.0, 13.1.1.2 |
710232-2 | 3-Major | BT710232 | platform-migrate fails when LACP trunks are in use | 14.1.0, 14.0.0.3, 13.1.1.2 |
709444-2 | 3-Major | BT709444 | "NTP not configured on device" warning seen when NTP symmetric key authentication is configured | 14.1.0, 13.1.1.2 |
709192-1 | 3-Major | BT709192 | GUI/iControl SOAP - KeyManagement export_all_to_archive_file failing immediately after HTTPD restart | 14.1.0, 14.0.0.3, 13.1.1.2 |
707740-4 | 3-Major | BT707740 | Failure deleting GTM Monitors when used on multiple virtual servers with the same ip:port combination | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.4.1, 11.6.4, 11.5.9 |
707509-1 | 3-Major | BT707509 | Initial vCMP guest creations can fail if certain hotfixes are used | 14.1.0, 13.1.1.2, 12.1.5 |
707391-2 | 3-Major | BT707391 | BGP may keep announcing routes after disabling route health injection | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
706804-1 | 3-Major | BT706804 | SNMP trap destination configuration of network option is missing "default" keyword | 14.1.0, 13.1.1.2 |
706354-2 | 3-Major | BT706354 | OPT-0045 optic unable to link | 14.0.0, 13.1.1.2, 12.1.4 |
706169-3 | 3-Major | BT706169 | tmsh memory leak | 14.1.0, 14.0.0.3, 13.1.1.2 |
705456-1 | 3-Major | BT705456 | Enabling HTTP-to-HTTPS redirection in a vCMP guest can prevent some Host-Guest Management features from working | 14.0.0, 13.1.1.2 |
704755-1 | 3-Major | BT704755 | EUD_M package could not be installed on 800 platforms | 14.1.0, 14.0.0.3, 13.1.1.2 |
704512-1 | 3-Major | BT704512 | Automated upload of qkview to iHealth can time out resulting in error | 14.0.0, 13.1.1.2 |
704336-1 | 3-Major | BT704336 | Updating 3rd party device cert not copied correctly to trusted certificate store | 14.1.0, 13.1.1.2, 12.1.3.6 |
702227-3 | 3-Major | BT702227 | Memory leak in TMSH load sys config | 14.1.0, 14.0.0.3, 13.1.1.2 |
700757-1 | 3-Major | BT700757 | vcmpd may crash when it is exiting | 14.0.0, 13.1.1.2, 12.1.4, 11.6.4 |
700576-1 | 3-Major | BT700576 | GUI - Server SSL Profile shows irrelevant options when "Server Certificate" is set to "Ignore" | 14.0.0, 13.1.1.2 |
700426 | 3-Major | K58033284, BT700426 | Switching partitions while viewing objects in GUI can result in empty list | 14.0.0, 13.1.1.2 |
700250-3 | 3-Major | K59327012, BT700250 | qkviews for secondary blade appear to be corrupt | 14.0.0, 13.1.1.2 |
698875-1 | 3-Major | Qkview Security Hardening | 14.0.0, 13.1.1.2 | |
698084-3 | 3-Major | K03776801, BT698084 | IPsec log messages in /var/log/ltm missing module ID to reach bigiq logs | 14.0.0, 13.1.1.2 |
696731-3 | 3-Major | K94062594, BT696731 | The standard LinkUp/LinkDown traps may not be issued in all cases when an interface is administratively enabled/disabled | 14.1.0, 13.1.1.2 |
693578-2 | 3-Major | BT693578 | switch/color_policer tmctl table is not available in 12.1.0 - 13.1.0 | 14.0.0, 13.1.1.2 |
692189-1 | 3-Major | BT692189 | errdefsd fails to generate a core file on request. | 14.0.0, 13.1.1.2, 12.1.4 |
692179-1 | 3-Major | BT692179 | Potential high memory usage from errdefsd. | 14.0.0, 13.1.1.2, 12.1.3.6 |
691609-1 | 3-Major | BT691609 | 1NIC: Configuration error: Clearing IP on interface mgmt failed - Cannot assign requested address★ | 14.0.0, 13.1.1.2 |
690890-1 | 3-Major | BT690890 | Running sod manually can cause issues/failover | 14.0.0, 13.1.1.2 |
689375-1 | 3-Major | K01512833, BT689375 | Unable configure 'Generic Alert' setting on SSL client/server profile through TMUI when 'Proxy SSL' is enabled | 14.0.0, 13.1.1.2 |
688406-1 | 3-Major | K14513346, BT688406 | HA-Group Score showing 0 | 14.0.0, 13.1.1.2 |
687905-2 | 3-Major | K72040312, BT687905 | OneConnect profile causes CMP redirected connections on the HA standby | 14.0.0, 13.1.1.2, 12.1.3.6 |
687534-1 | 3-Major | BT687534 | If a Pool contains ".." in the name, it is impossible to add a Member to this pool using the GUI Local Traffic > Pools : Member List page | 14.0.0, 13.1.1.2, 12.1.3.6 |
684391-3 | 3-Major | BT684391 | Existing IPsec tunnels reload. tmipsecd creates a core file. | 14.0.0, 13.1.1.2, 12.1.3.6 |
684218-1 | 3-Major | BT684218 | vADC 'live-install' Downgrade from v13.1.0 is not possible | 14.0.0, 13.1.1.2 |
681782-6 | 3-Major | BT681782 | Unicast IP address can be configured in a failover multicast configuration | 14.0.0, 13.1.1.2 |
679347-2 | 3-Major | K44117473, BT679347 | ECP does not work for PFS in IKEv2 child SAs | 14.0.0, 13.1.1.2, 12.1.3.6 |
678488-1 | 3-Major | K59332320, BT678488 | BGP default-originate not announced to peers if several are peering over different VLANs | 14.0.0, 13.1.1.2, 12.1.4.1 |
677485-1 | 3-Major | BT677485 | Discovery of DSC clustered BIG-IP systems fails due to secure value decryption error | 14.0.0, 13.1.1.2 |
671712-2 | 3-Major | BT671712 | The values returned for the ltmUserStatProfileStat table are incorrect. | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
670528-4 | 3-Major | K20251354, BT670528 | Warnings during vCMP host upgrade. | 14.1.0, 13.1.1.2, 12.1.3.7, 11.6.5.2 |
651413-4 | 3-Major | K34042229, BT651413 | tmsh list ltm node does not return an error when node does not exist | 14.0.0, 13.1.1.2, 12.1.3.4 |
642923-6 | 3-Major | BT642923 | MCP misses its heartbeat (and is killed by sod) if there are a large number of file objects on the system | 14.0.0, 13.1.1.2, 12.1.4 |
617643-2 | 3-Major | BT617643 | iControl.ForceSessions enabled results in GUI error on certain pages | 14.0.0, 13.1.1.2 |
551925-4 | 3-Major | BT551925 | Misdirected UDP traffic with hardware acceleration | 14.1.0, 13.1.1.2, 12.1.3.7, 11.6.4 |
464650-6 | 3-Major | BT464650 | Failure of mcpd with invalid authentication context. | 14.0.0, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.7 |
727297-3 | 4-Minor | BT727297 | GUI TACACS+ remote server list should accept hostname | 14.1.0, 13.1.1.2 |
725612-1 | 4-Minor | BT725612 | syslog-ng does not send any messages to the remote servers after reconfiguration | 14.1.0, 14.0.0.3, 13.1.1.2 |
719770-2 | 4-Minor | BT719770 | tmctl -H -V and -l options without values crashed | 14.1.0, 14.0.0.5, 13.1.1.2 |
714749-2 | 4-Minor | cURL Vulnerability: CVE-2018-1000120 | 14.1.0, 14.0.0.3, 13.1.1.2 | |
713947-1 | 4-Minor | BT713947 | stpd repeatedly logs "hal sendMessage failed" | 14.1.0, 13.1.1.2 |
713932-1 | 4-Minor | BT713932 | Commands are replicated to PostgreSQL even when not in use. | 14.1.0, 14.0.0.3, 13.1.1.2 |
707631-2 | 4-Minor | BT707631 | The 'SYN Challenge Handling' setting of a TCP profile can revert to defaults when updating the profile using the GUI | 14.1.0, 13.1.1.2 |
707267 | 4-Minor | BT707267 | REST Framework HTTP header limit size increased to 8 KB | 14.0.0.3, 13.1.1.2 |
701826 | 4-Minor | BT701826 | qkview upload to ihealth fails or unable to untar qkview file | 14.1.0, 13.1.1.2 |
691491-5 | 4-Minor | K13841403, BT691491 | 2000/4000, 10000, i2000/i4000, i5000/i7000/i10000, i15000, B4000 platforms may return incorrect SNMP sysIfxStatHighSpeed values for 10G/40G/100G interfaces | 14.0.0, 13.1.1.2 |
685582-7 | 4-Minor | BT685582 | Incorrect output of b64 unit key hash by command f5mku -f | 14.1.0, 13.1.1.2, 12.1.5.3 |
683029-1 | 4-Minor | BT683029 | Sync of virtual address and self IP traffic groups only happens in one direction | 14.0.0, 13.1.1.2 |
679135-2 | 4-Minor | BT679135 | IKEv1 and IKEv2 cannot share common local address in tunnels | 14.0.0, 13.1.1.2, 12.1.3.6 |
678388-1 | 4-Minor | K00050055, BT678388 | IKEv1 racoon daemon is not restarted when killed multiple times | 14.0.0, 13.1.1.2, 12.1.3.6 |
550526-2 | 4-Minor | K84370515, BT550526 | Some time zones prevent configuring trust with a peer device using the GUI. | 13.1.1.2, 12.1.3.7 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
722594-2 | 1-Blocking | BT722594 | TCP flow may not work as expected if double tagging is used | 14.1.0, 14.0.0, 13.1.1.2 |
737445-2 | 2-Critical | BT737445 | Use of TCP Verified Accept can disable server-side flow control | 14.1.0, 14.0.0.3, 13.1.1.2 |
727044-2 | 2-Critical | TMM may crash while processing compressed data | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 | |
726239-4 | 2-Critical | BT726239 | interruption of traffic handling as sod daemon restarts TMM | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4, 11.6.3.3, 11.5.9 |
725545-1 | 2-Critical | BT725545 | Ephemeral listener might not be set up correctly | 14.1.0, 14.0.0, 13.1.1.2 |
724906-1 | 2-Critical | BT724906 | sasp_gwm monitor leaks memory over time | 14.1.0, 14.0.0.3, 13.1.1.2 |
724868-1 | 2-Critical | BT724868 | dynconfd memory usage increases over time | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
724213-1 | 2-Critical | K74431483, BT724213 | Modified ssl_profile monitor param not synced correctly | 14.1.0, 14.0.0.3, 13.1.1.2 |
722893-1 | 2-Critical | K30764018, BT722893 | TMM can restart without a stack trace or core file after becoming disconnected from MCPD. | 14.1.0, 14.0.0, 13.1.1.2 |
716213-1 | 2-Critical | BT716213 | BIG-IP system issues TCP-Reset with error 'SSID error (Out of Bounds)' in traffic | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.3.7 |
713612-1 | 2-Critical | BT713612 | tmm might restart if the HTTP passthrough on pipeline option is used | 14.1.0, 13.1.1.2 |
710221-2 | 2-Critical | K67352313, BT710221 | Ephemeral node stays Unavailable on 'standby' BIG-IP system after a forced-offline FQDN node is re-enabled | 14.1.0, 14.0.0.3, 13.1.1.2 |
673664-1 | 2-Critical | BT673664 | TMM crashes when sys db Crypto.HwAcceleration is disabled.★ | 14.0.0, 13.1.1.2 |
635191-2 | 2-Critical | BT635191 | Under rare circumstances TMM may crash | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.7 |
727222-1 | 3-Major | BT727222 | 206 Partial Content responses from ramcache have malformed Content-Range header | 14.1.0, 13.1.1.2 |
723300-2 | 3-Major | BT723300 | TMM may crash when tracing iRules containing nameless listeners on internal virtual servers | 14.1.0, 14.0.0, 13.1.1.2 |
722363-2 | 3-Major | BT722363 | Client fails to connect to server when using PVA offload at Established | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3 |
721261-1 | 3-Major | BT721261 | v12.x Policy rule names containing slashes are not migrated properly | 14.1.0, 14.0.0.5, 13.1.1.2 |
720293-3 | 3-Major | BT720293 | HTTP2 IPv4 to IPv6 fails | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
719600-2 | 3-Major | BT719600 | TCP::collect iRule with L7 policy present may result in connection reset | 14.1.0, 14.0.0.3, 13.1.1.2 |
717346-2 | 3-Major | K13040347, BT717346 | [WebSocket ] tmsh show /ltm profile WebSocket current and max numbers far larger than total | 16.1.0, 16.0.1.1, 14.1.0, 14.0.0.3, 13.1.1.2 |
715883 | 3-Major | BT715883 | Tmm crash due to invalid cookie attribute | 14.1.0, 14.0.0.3, 13.1.1.2 |
715785-2 | 3-Major | BT715785 | Incorrect encryption error for monitors during sync or upgrade | 14.1.0, 14.0.0.5, 13.1.1.2 |
715756-2 | 3-Major | BT715756 | Clusterd may not trigger primary election when primary blade has critical filesystems mounted read-only | 14.1.0, 13.1.1.2 |
715467-2 | 3-Major | BT715467 | Ephemeral pool member and node are not updated on 'A' record changes if pool member port is ANY | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.5 |
714384-3 | 3-Major | BT714384 | DHCP traffic may not be forwarded when BWC is configured | 15.1.0, 14.0.0.3, 13.1.1.2 |
707951-2 | 3-Major | BT707951 | Stalled mirrored flows on HA next-active when OneConnect is used. | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.6 |
704764-3 | 3-Major | BT704764 | SASP monitor marks members down with non-default route domains | 14.1.0, 14.0.0.3, 13.1.1.2 |
703580-1 | 3-Major | BT703580 | TLS1.1 handshake failure on v12.1.3 vCMP guest with earlier BIG-IP version on vCMP host. | 14.1.0, 13.1.1.2, 12.1.3.6 |
703266-2 | 3-Major | BT703266 | Potential MCP memory leak in LTM policy compile code | 14.1.0, 13.1.1.2 |
702450-1 | 3-Major | BT702450 | The validation error message generated by deleting certain object types referenced by a policy action is incorrect | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.5, 11.6.4 |
701690-1 | 3-Major | K53819652, BT701690 | Fragmented ICMP forwarded with incorrect icmp checksum | 14.0.0, 13.1.1.2 |
700696-1 | 3-Major | BT700696 | SSID does not cache fragmented Client Certificates correctly via iRule | 14.0.0, 13.1.1.2, 12.1.3.7 |
699273-1 | 3-Major | BT699273 | TMM Core During FTP Monitor Use | 14.0.0, 13.1.1.2 |
695925-1 | 3-Major | BT695925 | Tmm crash when showing connections for a CMP disabled virtual server | 14.0.0, 13.1.1.2, 12.1.4, 11.6.4 |
691785-1 | 3-Major | BT691785 | The bcm570x driver can cause TMM to core when transmitting packets larger than 6144 bytes | 14.0.0, 13.1.1.2 |
691224-3 | 3-Major | K59327001, BT691224 | Fragmented SSL Client Hello message do not get properly reassembled when SSL Persistence is enabled | 14.0.0, 13.1.1.2, 12.1.3.7 |
690778-1 | 3-Major | K53531153, BT690778 | Memory can leak if the STREAM::replace command is called more than once in the STREAM_MATCHED event in an iRule | 14.0.0, 13.1.1.2 |
688629-1 | 3-Major | K52334096, BT688629 | Deleting data-group in use by iRule does not trigger validation error | 14.0.0, 13.1.1.2, 12.1.5 |
685110-1 | 3-Major | K05430133, BT685110 | With a non-LTM license (ASM, APM, etc.), ephemeral nodes will not be created for FQDN nodes/pool members. | 14.0.0, 13.1.1.2, 12.1.3.2 |
681757-3 | 3-Major | K32521651, BT681757 | Upgraded volume may fail to load if a Local Traffic Policy uses the forward parameter 'member' | 14.0.0, 13.1.1.2, 12.1.3.6 |
681673-4 | 3-Major | BT681673 | tmsh modify FDB command permits multicast MAC addresses, which produces unexpected results | 14.0.0, 13.1.1.2 |
679613-1 | 3-Major | K23531420, BT679613 | i2000/i4000 Platforms Improperly Handle VLANs Created with a Value of '1' | 14.0.0, 13.1.1.2 |
672312-3 | 3-Major | BT672312 | IP ToS may not be forwarded to serverside with syncookie activated | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.4 |
602708-4 | 3-Major | K84837413, BT602708 | Traffic may not passthrough CoS by default | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
716922-2 | 4-Minor | BT716922 | Reduction in PUSH flags when Nagle Enabled | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7, 11.6.3.3, 11.5.7 |
712637-2 | 4-Minor | BT712637 | Host header persistence not implemented | 14.1.0, 14.0.0.3, 13.1.1.2 |
700433-1 | 4-Minor | K10870739, BT700433 | Memory leak when attaching an LTM policy to a virtual server | 14.0.0, 13.1.1.2, 12.1.3.6, 11.6.4 |
697988-3 | 4-Minor | K34554754, BT697988 | During config sync, if many client-ssl profiles are on a virtual server the CPU may briefly spike to 100% | 14.1.0, 13.1.1.2 |
693966-1 | 4-Minor | BT693966 | TCP sndpack not reset along with other tcp profile stats | 14.1.0, 13.1.1.2 |
688557-1 | 4-Minor | K50462482, BT688557 | Tmsh help for ltm sasp monitor incorrectly lists default mode as 'pull' | 14.0.0, 13.1.1.2 |
495242-4 | 4-Minor | BT495242 | mcpd log messages: Failed to unpublish LOIPC object | 14.1.0, 13.1.1.2, 12.1.3.6, 11.6.4, 11.5.6 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
718885-3 | 2-Critical | K25348242, BT718885 | Under certain conditions, monitor probes may not be sent at the configured interval | 14.1.0, 14.0.0, 13.1.1.2, 12.1.3.7 |
723792-2 | 3-Major | BT723792 | GTM regex handling of some escape characters renders it invalid | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
719644-2 | 3-Major | BT719644 | If auto-discovery is enabled, GTM configuration may be affected after an upgrade from 11.5.x to later versions★ | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.3.7 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
737500-2 | 2-Critical | BT737500 | Apply Policy and Upgrade time degradation when there are previous enforced rules | 14.1.0, 14.0.0.5, 13.1.1.2 |
726090-1 | 2-Critical | BT726090 | No Bot Defense Logs when ASM Policy is used without Proactive Bot Defense | 14.0.0.5, 13.1.1.2 |
724414-2 | 2-Critical | BT724414 | ASM UMU memory leak when WebSocket url has json profile with parse parameters enabled | 14.1.0, 14.0.0.5, 13.1.1.2 |
724032-1 | 2-Critical | BT724032 | Searching Request Log for value containing backslash does not return expected result | 14.1.0, 14.0.0.5, 13.1.1.2 |
721741-3 | 2-Critical | BT721741 | BD and BD_Agent out-of-sync for IP Address Exception, false positive/negative | 14.1.0.2, 14.1.0, 13.1.1.2, 12.1.3.7 |
704143-1 | 2-Critical | BT704143 | BD memory leak | 14.0.0, 13.1.1.2, 12.1.3.6 |
701856-1 | 2-Critical | BT701856 | Memory leak in ASM-config Event Dispatcher upon continuous Policy Builder restart | 14.1.0, 13.1.1.2, 12.1.3.7 |
740719-2 | 3-Major | BT740719 | ASM CSP header parser does not honor unsafe-inline attribute within script-src directive | 14.1.0, 14.0.0.5, 13.1.1.2 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
737867-1 | 3-Major | BT737867 | Scheduled reports are being incorrectly displayed in different partitions | 14.1.0, 14.0.1.1, 13.1.1.2 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
739716-2 | 1-Blocking | BT739716 | APM Subroutine loops without finishing | 14.1.0, 14.0.0.5, 13.1.1.2 |
740777-1 | 2-Critical | BT740777 | Secondary blades mcp daemon restart when subroutine properties are configured | 14.1.0, 13.1.1.2, 12.1.4 |
739674-1 | 2-Critical | BT739674 | TMM might core in SWG scenario with per-request policy. | 14.1.0, 13.1.1.2 |
722013 | 2-Critical | BT722013 | MCPD restarts on all secondary blades post config-sync involving APM customization group | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.3.7 |
713820-1 | 2-Critical | BT713820 | Pass in IP address to urldb categorization engine | 14.1.0, 13.1.1.2 |
739939-1 | 3-Major | BT739939 | Ping Access Agent Module leaks memory in TMM. | 14.1.0, 14.0.0.5, 13.1.1.2 |
739190 | 3-Major | BT739190 | Policies could be exported with not patched /Common partition | 13.1.1.2 |
738582-1 | 3-Major | BT738582 | Ping Access Agent Module leaks memory in TMM. | 14.1.0, 14.0.0.5, 13.1.1.2 |
738397-1 | 3-Major | BT738397 | SAML -IdP-initiated case that has a per-request policy with a logon page in a subroutine fails. | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.3.7 |
737355-1 | 3-Major | BT737355 | HTTP Strict-Transport-Security (HSTS) headers not being added to all APM generated files | 14.1.0, 13.1.1.2 |
737064-2 | 3-Major | BT737064 | ACCESS::session iRule commands may not work in serverside events | 14.1.0, 13.1.1.2 |
726895 | 3-Major | K02205915, BT726895 | VPE cannot modify subroutine settings | 13.1.1.2, 12.1.3.7 |
726616-1 | 3-Major | BT726616 | TMM crashes when a session is terminated | 14.1.0, 14.0.0.5, 13.1.1.2 |
726592-1 | 3-Major | BT726592 | Invalid logsetting config messaging between our daemons could send apmd, apm_websso, localdbmgr into infinite loop | 14.1.0, 13.1.1.2, 12.1.4 |
725867-2 | 3-Major | BT725867 | ADFS proxy does not fetch configuration for non-floating virtual servers | 14.1.0, 14.0.0.5, 13.1.1.2 |
725412-1 | 3-Major | APM does not follow current best practices for HTTP headers | 14.1.0, 14.0.0, 13.1.1.2 | |
724571-1 | 3-Major | BT724571 | Importing access profile takes a long time | 14.1.0, 13.1.1.2 |
722969-2 | 3-Major | BT722969 | Access Policy import with 'reuse' enabled instead rewrites shared objects | 14.1.0, 14.0.0, 13.1.1.2, 12.1.4.1 |
722423-1 | 3-Major | BT722423 | Analytics agent always resets when Category Lookup is of type custom only | 14.1.0, 14.0.0.5, 13.1.1.2 |
720757-1 | 3-Major | BT720757 | Without proper licenses Category Lookup always fails with license error in Allow Ending | 14.1.0, 14.0.0.5, 13.1.1.2 |
713655-2 | 3-Major | BT713655 | RouteDomainSelectionAgent might fail under heavy control plane traffic/activities | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.3.7 |
711427-2 | 3-Major | BT711427 | Edge Browser does not launch F5 VPN App | 14.1.0, 14.0.0, 13.1.1.2 |
710884-1 | 3-Major | BT710884 | Portal Access might omit some valid cookies when rewriting HTTP request. | 14.1.0, 14.0.0.5, 13.1.1.2 |
701800-2 | 3-Major | K29064506, BT701800 | SSO-enabled native RDP resources cannot be launched from APM Webtop with Mac RDP client 10.x | 14.1.0, 14.0.0.5, 13.1.1.2 |
701056-1 | 3-Major | BT701056 | User is not able to reset their Active Directory password | 14.0.0, 13.1.1.2 |
698984-1 | 3-Major | BT698984 | Auto-disable TMM.HTTP.TCL.Validation when APM is provisioned | 14.0.0, 13.1.1.2 |
696669-1 | 3-Major | BT696669 | Users cannot change or reset RSA PIN | 14.0.0, 13.1.1.2 |
696544-1 | 3-Major | BT696544 | APM end users can not change/reset password when auth agents are included in per-req policy | 14.0.0, 13.1.1.2 |
671323-1 | 3-Major | BT671323 | Reset PIN Fail if Token input field is not 'password' field | 14.0.0, 13.1.1.2 |
734595-2 | 4-Minor | BT734595 | sp-connector is not being deleted together with profile | 14.1.0, 13.1.1.2 |
721375-1 | 4-Minor | BT721375 | Export then import of config with RSA server in it might fail | 13.1.1.2, 12.1.3.7 |
WebAccelerator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
706642-2 | 2-Critical | BT706642 | wamd may leak memory during configuration changes and cluster events | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4, 11.6.4, 11.5.9 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
709383-2 | 3-Major | BT709383 | DIAMETER::persist reset non-functional | 14.1.0, 13.1.1.2 |
706750-1 | 3-Major | BT706750 | Changing CGNAT SIP ALG profile log settings while handling traffic may cause tmm crash. | 14.1.0, 14.0.0, 13.1.1.2 |
691048-1 | 3-Major | K34553736, BT691048 | Support DIAMETER Experimental-Result AVP response | 14.0.0, 13.1.1.2 |
688942-5 | 3-Major | BT688942 | ICAP: Chunk parser performs poorly with very large chunk | 14.0.0, 13.1.1.2, 12.1.3.6 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
724532-2 | 2-Critical | BT724532 | SIG SEGV during IP intelligence category match in TMM | 14.1.0, 13.1.1.2, 12.1.4 |
720045-1 | 2-Critical | BT720045 | IP fragmented UDP DNS request and response packets dropped as DNS Malformed | 14.1.0, 14.0.0, 13.1.1.2 |
710755-1 | 2-Critical | BT710755 | TMM crash when route information becomes stale and the system accesses stale information. | 14.0.0, 13.1.1.2, 12.1.4 |
698333-1 | 2-Critical | K43392052, BT698333 | TMM core upon matching a past (saved) dynamic signature of a specific family (network or dns) after the dynamic signature is disabled for that family on the parent context (but still enabled for other families) | 14.0.0, 13.1.1.2 |
694849-1 | 2-Critical | BT694849 | TMM crash when packet sampling is turned for DNS BDOS signatures. | 14.0.0, 13.1.1.2 |
672514-1 | 2-Critical | BT672514 | Local Traffic/Virtual Server/Security page crashed | 14.0.0, 13.1.1.2 |
630137-2 | 2-Critical | BT630137 | Dynamic Signatures feature can fill up /config partition impacting system stability | 14.1.0, 14.0.0, 13.1.1.2 |
726154-2 | 3-Major | BT726154 | TMM restart when there are virtual server and route-domains with the same names and attached firewall or NAT policies | 14.1.0, 13.1.1.2, 12.1.5.3 |
704528-2 | 3-Major | BT704528 | tmm may run out of memory during IP shunning | 14.0.0, 13.1.1.2 |
704369-2 | 3-Major | BT704369 | TMM on BIG-IP restarts if a dos profile is attached to a virtual with sip-routing enabled | 14.0.0, 13.1.1.2 |
696201-1 | 3-Major | BT696201 | Anomaly threshold floor calculation (for bins with very low learnt threshold) during signature generation | 14.0.0, 13.1.1.2 |
686376-2 | 3-Major | BT686376 | Scheduled blob and current blob no longer work after restarting BIG-IP or PCCD daemon | 14.0.0, 13.1.1.2, 12.1.4.1 |
707054-1 | 4-Minor | BT707054 | SYN Cookie MSS for Fast L4 Profiles is limited to 256-9162 | 14.1.0, 13.1.1.2 |
699454-4 | 4-Minor | Web UI does not follow current best coding practices | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
726647-3 | 3-Major | BT726647 | PEM content insertion in a compressed response may truncate some data | 15.0.0, 14.1.0.2, 14.0.0.3, 13.1.1.2, 12.1.4.1 |
721704-1 | 3-Major | BT721704 | UDP flows are not deleted after subscriber deletion | 14.1.0, 13.1.1.2 |
709670-2 | 3-Major | BT709670 | iRule triggered from RADIUS occasionally fails to create subscribers. | 14.1.0, 14.0.0.5, 13.1.1.2, 12.1.5 |
Carrier-Grade NAT Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
721570-1 | 1-Blocking | K20285019, BT721570 | TMM core when trying to log an unknown subscriber | 14.1.0, 14.0.0, 13.1.1.2 |
734446-2 | 2-Critical | BT734446 | TMM crash after changing LSN pool mode from PBA to NAPT | 14.1.0, 14.0.0.3, 13.1.1.2, 12.1.4, 11.6.4 |
688246-1 | 2-Critical | BT688246 | An invalid mode in the LSN::persistence command causes TMM crash | 14.0.0, 13.1.1.2 |
708830-2 | 3-Major | BT708830 | Inbound or hairpin connections may get stuck consuming memory. | 14.0.0, 13.1.1.2, 12.1.4.1 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
738669-2 | 3-Major | BT738669 | Login validation may fail for a large request with early server response | 14.1.0, 13.1.1.2, 12.1.3.7 |
737368-1 | 3-Major | BT737368 | Fingerprint cookie large value may result in tmm core. | 14.1.0, 14.0.1.1, 13.1.1.2 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
739277 | 2-Critical | BT739277 | TMM core when the virtual server is deleted during POST data and BADOS standard/aggressive mode | 14.1.0, 14.0.0.5, 13.1.1.2 |
720585-1 | 3-Major | BT720585 | Signatures generated by Behavioral DOS algorithm can create false-positive signatures | 14.1.0, 14.0.0.5, 13.1.1.2 |
689540-1 | 3-Major | BT689540 | The same DOS attack generates new signatures even if there are signatures generated during previous attacks. | 14.0.0, 13.1.1.2 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
726303-1 | 3-Major | BT726303 | Unlock 10 million custom db entry limit | 14.1.0, 13.1.1.2, 12.1.3.7 |
iApp Technology Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
726872-2 | 3-Major | BT726872 | iApp LX directory disappears after upgrade or restoring from UCS★ | 14.1.0, 14.0.1.1, 13.1.1.2 |
Cumulative fixes from BIG-IP v13.1.1.1 that are included in this release
Functional Change Fixes
None
Cumulative fixes from BIG-IP v13.1.1 that are included in this release
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
693359-1 | 1-Blocking | BT693359 | AWS M5 and C5 instance families are supported | 14.1.0, 14.0.0.1, 13.1.1 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
721364 | 1-Blocking | BT721364 | BIG-IP per-application VE BYOL license does not support three wildcard virtual servers | 14.1.0, 14.0.0.1, 13.1.1 |
716469 | 1-Blocking | BT716469 | OpenSSL 1.0.1l fails with 512 bit DSA keys | 13.1.1 |
697615-1 | 1-Blocking | K65013424, BT697615 | Neurond may restart indefinitely after boot, with neurond_i2c_config message | 14.0.0, 13.1.1 |
675921-2 | 1-Blocking | BT675921 | Creating 5th vCMP 'ssl-mode dedicated' guest results in an error, but is running | 14.0.0, 13.1.1, 12.1.3.1 |
723130-1 | 2-Critical | K13996, BT723130 | Invalid-certificate warning displayed when deploying BIG-IP VE OVA file | 14.1.0, 14.0.0, 13.1.1, 12.1.3.6, 11.6.3.3, 11.5.8 |
700086-1 | 2-Critical | BT700086 | AWS C5/M5 Instances do not support BIG-IP VE | 14.1.0, 14.0.0.1, 13.1.1 |
696732-3 | 2-Critical | K54431534, BT696732 | tmm may crash in a compression provider | 14.0.0, 13.1.1, 12.1.3.5 |
721985 | 3-Major | BT721985 | PAYG License remains inactive as dossier verification fails. | 14.0.0.1, 13.1.1 |
721512 | 3-Major | BT721512 | Config tool fails to configure management-ip when default routes exist for both IPv4 and IPv6. | 13.1.1 |
721342 | 3-Major | BT721342 | No support for Per-App VE LTM and Per-App VE WAF images for various cloud environments. | 14.1.0, 14.0.0.1, 13.1.1 |
720961-1 | 3-Major | BT720961 | Upgrading in Intelligence Community AWS environment may fail | 14.1.0, 14.0.0.1, 13.1.1 |
720756-1 | 3-Major | BT720756 | SNMP platform name is unknown on i11400-DS/i11600-DS/i11800-DS | 14.1.0, 13.1.1, 12.1.3.6 |
720651-2 | 3-Major | BT720651 | Running Guest Changed to Provisioned Never Stops | 14.1.0, 14.0.0.3, 13.1.1, 12.1.4 |
720104-1 | 3-Major | BT720104 | BIG-IP i2800/i2600 650W AC PSU has marketing name missing under 'show sys hardware' | 14.1.0, 14.0.0.3, 13.1.1, 12.1.3.6 |
719396-1 | 3-Major | K34339214, BT719396 | DHCP Client on BIG-IP sends host-name 'localhost' in DISCOVER packet after first boot. | 14.1.0, 14.0.0.1, 13.1.1 |
717832 | 3-Major | BT717832 | Remove unneeded files from UCS backup directories | 13.1.1 |
714303-1 | 3-Major | K25057050, BT714303 | X520 virtual functions do not support MAC masquerading | 14.1.0, 14.0.0.1, 13.1.1 |
712266-1 | 3-Major | BT712266 | Decompression of large buffer might fail with comp_code=11 with Nitrox 3 hardware | 14.1.0, 13.1.1 |
697616-2 | 3-Major | BT697616 | Report Device error: crypto codec qat-crypto0-0 queue is stuck on vCMP guests | 14.0.0, 13.1.1, 12.1.3.5 |
680086 | 3-Major | BT680086 | BMC firmware fails md5sum check | 14.0.0, 13.1.1 |
673996-2 | 3-Major | BT673996 | Unable to set 'media-fixed' on management port on BIG-IP i15000 platforms | 14.0.0, 13.1.1 |
680388-1 | 4-Minor | BT680388 | f5optics should not show function name in non-debug log messages | 14.0.0, 13.1.1, 12.1.3.5 |
653759-1 | 4-Minor | BT653759 | Chassis Variant number is not specified in C2200/C2400 chassis after a firmware update★ | 14.0.0, 13.1.1, 12.1.3.5 |
720391-2 | 5-Cosmetic | BT720391 | BIG-IP i7800 Dual SSD reports wrong marketing name under 'show sys hardware' | 14.1.0, 14.0.0.3, 13.1.1, 12.1.3.6 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
737550 | 2-Critical | BT737550 | State Mirroring between BIG-IP 13.0.x and 13.1.x systems may cause TMM core on standby system during upgrade★ | 13.1.1 |
701538-2 | 2-Critical | BT701538 | SSL handshake fails for OCSP, TLS false start, and SSL hardware acceleration configured | 14.0.0, 13.1.1, 12.1.3.5 |
720460-1 | 3-Major | BT720460 | Compression traffic still goes to hardware accelerator when compression.strategy is set to softwareonly | 15.0.0, 14.1.0, 13.1.1 |
694778-1 | 3-Major | BT694778 | Certain Intel Crypto HW fails to decrypt data if the given output buffer size differs from RSA private key size | 14.0.0, 13.1.1, 12.1.3.5 |
686631-2 | 3-Major | BT686631 | Deselect a compression provider at the end of a job and reselect a provider for a new job | 14.0.0, 13.1.1, 12.1.3.5 |
679494-1 | 3-Major | BT679494 | Change the default compression strategy to speed | 14.0.0, 13.1.1, 12.1.3.5 |
495443-9 | 3-Major | K16621, BT495443 | ECDH negotiation failures logged as critical errors. | 14.0.0, 13.1.1, 12.1.3.5, 11.5.3 |
679496-2 | 4-Minor | BT679496 | Add 'comp_req' to the output of 'tmctl compress' | 14.0.0, 13.1.1, 12.1.3.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
717909 | 2-Critical | BT717909 | tmm can abort on sPVA flush if the HSB flush does not succeed | 14.1.0, 14.0.0, 13.1.1 |
701637 | 2-Critical | BT701637 | Crash in bcm56xxd during TMM failover | 13.1.1 |
702738-1 | 3-Major | K32181540, BT702738 | Tmm might crash activating new blob when changing firewall rules | 14.1.0, 13.1.1, 12.1.3.4 |
698182 | 3-Major | BT698182 | Upgrading from 13.1.1 to newer release might cause config to not be copied over★ | 13.1.1 |
697516 | 3-Major | BT697516 | Upgrading using a ucs or scf file does not autogenerate uuids when current config has the uuid-default-autogenerate flag enabled | 13.1.1 |
Cumulative fixes from BIG-IP v13.1.0.8 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
716992-2 | CVE-2018-5539 | K75432956, BT716992 | The ASM bd process may crash | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.7 |
710244-3 | CVE-2018-5536 | K27391542, BT710244 | Memory Leak of access policy execution objects | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6 |
710140-1 | CVE-2018-5527 | K20134942, BT710140 | TMM may consume excessive resources when processing SSL Intercept traffic | 14.0.0, 13.1.0.8 |
709688-3 | CVE-2017-3144 CVE-2018-5732 CVE-2018-5733 |
K08306700, BT709688 | dhcp Security Advisory - CVE-2017-3144, CVE-2018-5732, CVE-2018-5733 | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6 |
695072-2 | CVE-2016-8399 CVE-2017-1000111 CVE-2017-1000112 CVE-2017-11176 CVE-2017-14106 CVE-2017-7184 CVE-2017-7541 CVE-2017-7542 CVE-2017-7558 |
K23030550, BT695072 | CVE-2016-8399 CVE-2017-1000111 CVE-2017-1000112 CVE-2017-11176 CVE-2017-14106 CVE-2017-7184 CVE-2017-7541 CVE-2017-7542 CVE-2017-7558 | 14.1.0, 14.0.0.3, 13.1.0.8 |
693744-4 | CVE-2018-5531 | K64721111, BT693744 | CVE-2018-5531: vCMP vulnerability | 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.7 |
651741-2 | CVE-2017-5970, | K60104355, BT651741 | CVE-2017-5970 kernel.el7: ipv4: Invalid IP options could cause skb->dst drop | 14.1.0, 14.0.0.3, 13.1.0.8 |
717900-2 | CVE-2018-5528 | K27044729, BT717900 | TMM crash while processing APM data | 14.1.0, 14.0.0, 13.1.0.8 |
710827-2 | CVE-2019-6598 | K44603900, BT710827 | TMUI dashboard daemon stability issue | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.3, 11.5.9 |
710148-2 | CVE-2017-1000111 CVE-2017-1000112 |
K60250153, BT710148 | CVE-2017-1000111 & CVE-2017-1000112 | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.3, 11.5.7 |
709256-2 | CVE-2017-9074 CVE-2017-7542 |
K61223103, BT709256 | CVE-2017-9074: Local Linux Kernel Vulnerability | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.3, 11.6.3.1, 11.5.6 |
705476-2 | CVE-2018-15322 | K28003839, BT705476 | Appliance Mode does not follow design best practices | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.3, 11.5.7 |
698813-2 | CVE-2018-5538 | K45435121, BT698813 | When processing DNSX transfers ZoneRunner does not enforce best practices | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
688625-5 | CVE-2017-11628 | K75543432, BT688625 | PHP Vulnerability CVE-2017-11628 | 14.0.0, 13.1.0.8, 12.1.3.2, 11.6.3.2, 11.5.7 |
662850-6 | CVE-2015-2716 | K50459349, BT662850 | Expat XML library vulnerability CVE-2015-2716 | 14.0.0, 13.1.0.8, 12.1.3.2, 11.6.3.2, 11.5.7 |
714879-3 | CVE-2018-15326 | K34652116, BT714879 | APM CRLDP Auth passes all certs | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6, 11.6.3.3 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
685020-3 | 3-Major | BT685020 | Enhancement to SessionDB provides timeout | 14.0.0, 13.1.0.8, 12.1.3.2 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708956-1 | 1-Blocking | K51206433, BT708956 | During system boot, error message displays: 'Dataplane INOPERABLE - only 1 HSBes found on this platform' | 14.1.0, 14.0.1.1, 13.1.0.8, 12.1.3.5 |
719597 | 2-Critical | BT719597 | HA between VIPRION chassis with B2250 blades might not work when running v12.1.1 and v13.1.0 | 14.1.0, 14.0.0.3, 13.1.0.8 |
715820-1 | 2-Critical | BT715820 | vCMP in HA configuration with VIPRION chassis might cause unstable data plane | 14.1.0, 13.1.0.8 |
712401-1 | 2-Critical | BT712401 | Enhanced administrator lock/unlock for Common Criteria compliance | 14.1.0, 13.1.0.8 |
676203-3 | 2-Critical | BT676203 | Inter-blade mpi connection fails, does not recover, and eventually all memory consumed. | 14.0.0, 13.1.0.8, 12.1.3.2 |
665362-2 | 2-Critical | BT665362 | MCPD might crash if the AOM restarts | 14.0.0, 13.1.0.8, 12.1.3.6 |
581851-6 | 2-Critical | K16234725, BT581851 | mcpd process on secondary blades unexpectedly restarts when the system processes multiple tmsh commands | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.9 |
711249-1 | 3-Major | BT711249 | NAS-IP-Address added to RADIUS packet unexpectedly | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.4 |
710976-1 | 3-Major | BT710976 | Network Map can take a long time to load. | 14.1.0, 14.0.0.3, 13.1.0.8 |
708484-2 | 3-Major | BT708484 | Network Map might take a long time to load | 14.1.0, 14.0.0.3, 13.1.0.8 |
707445-3 | 3-Major | K47025244 | Nitrox 3 compression hangs/unable to recover | 14.1.0, 13.1.0.8, 12.1.3.6, 11.6.3.3, 11.5.9 |
705818-1 | 3-Major | BT705818 | GUI Network Map Policy with forward Rule to Pool, Pool does not show up | 14.0.0, 13.1.0.8 |
704804-1 | 3-Major | BT704804 | The NAS-IP-Address in RADIUS remote authentication is unexpectedly set to the loopback address | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.3 |
704733-1 | 3-Major | BT704733 | NAS-IP-Address is sent with the bytes in reverse order | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.3 |
704247-2 | 3-Major | BT704247 | BIG-IP software may fail to install if multiple copies of the same image are present and have been deleted | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.7 |
701249-1 | 3-Major | BT701249 | RADIUS authentication requests erroneously specify NAS-IP-Address of 127.0.0.1 | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.3 |
700895-1 | 3-Major | K34944451, BT700895 | GUI Network Map objects in subfolders are not being shown | 14.0.0, 13.1.0.8 |
696260-1 | 3-Major | K53103420, BT696260 | GUI Network Map as Start Screen presents database error | 14.0.0, 13.1.0.8 |
694696-5 | 3-Major | BT694696 | On multiblade Viprion, creating a new traffic-group causes the device to go Offline | 14.0.0, 13.1.0.8, 12.1.3.2 |
694547-2 | 3-Major | K74203532, BT694547 | TMSH save sys config creates unneeded generate_config processes. | 14.0.0, 13.1.0.8 |
689730-3 | 3-Major | BT689730 | Software installations from v13.1.0 might fail★ | 13.1.0.8, 12.1.3.5 |
687658 | 3-Major | BT687658 | Monitor operations in transaction will cause it to stay unchecked | 14.0.0, 13.1.0.8, 12.1.3.2, 11.6.3.3 |
686906-2 | 3-Major | BT686906 | Fragmented IPv6 packets not handled correctly on Virtual Edition | 14.0.0, 13.1.0.8 |
674455-5 | 3-Major | BT674455 | Serial console baud rate setting lost after running 'tmidiag -r' in Maintenance OS | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.5 |
678254-1 | 4-Minor | BT678254 | Error logged when restarting Tomcat | 14.0.0, 13.1.0.8, 12.1.3.7 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
721571-1 | 2-Critical | BT721571 | State Mirroring between BIG-IP 12.1.3.* and 13.* or 14.* systems may cause TMM core on standby system during upgrade★ | 14.1.0, 13.1.0.8 |
718071-1 | 2-Critical | BT718071 | HTTP2 with ASM policy not passing traffic | 14.0.0, 13.1.0.8, 12.1.3.6 |
715747 | 2-Critical | BT715747 | TMM may restart when running traffic through custom SSLO deployments. | 14.1.0, 14.0.0, 13.1.0.8 |
709828-2 | 2-Critical | BT709828 | fasthttp can crash with Large Receive Offload enabled | 14.1.0, 14.0.0.3, 13.1.0.8 |
707244-3 | 2-Critical | BT707244 | iRule command clientside and serverside may crash tmm | 14.0.0, 13.1.0.8 |
707207-1 | 2-Critical | BT707207 | iRuleLx returning undefined value may cause TMM restart | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6 |
700597-1 | 2-Critical | BT700597 | Local Traffic Policy on HTTP/2 virtual server no longer matches | 14.0.0, 13.1.0.8 |
700056-1 | 2-Critical | BT700056 | MCPD process may lock up and restart when applying Local Traffic Policy to virtual server | 14.1.0, 14.0.0.3, 13.1.0.8 |
690756-1 | 2-Critical | BT690756 | APM depends on undocumented internal behavior of HTTP iRule commands after a retry is initiated | 14.0.0, 13.1.0.8 |
571651-4 | 2-Critical | BT571651 | Reset Nitrox3 crypto accelerator queue if it becomes stuck. | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.9 |
713951-5 | 3-Major | BT713951 | tmm core files produced by nitrox_diag may be missing data | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.7 |
713934-2 | 3-Major | BT713934 | Using iRule 'DNS::question name' to shorten the name in DNS_REQUEST may result malformed TC response | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6 |
712819-2 | 3-Major | BT712819 | 'HTTP::hsts preload' iRule command cannot be used | 14.1.0, 14.0.0.3, 13.1.0.8 |
712475-3 | 3-Major | K56479945, BT712475 | DNS zones without servers will prevent DNS Express reading zone data | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
712437-3 | 3-Major | K20355559, BT712437 | Records containing hyphens (-) will prevent child zone from loading correctly | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
711281-5 | 3-Major | BT711281 | nitrox_diag may run out of space on /shared | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.7 |
710996-2 | 3-Major | BT710996 | VIPRION outgoing management IPv6 traffic from primary blade uses the cluster member IP | 14.1.0, 13.1.0.8 |
709133-2 | 3-Major | BT709133 | When the BigDB variable tmm.ssl.loggingcreatedcerts is set, a double-free error might occur | 14.1.0, 14.0.0.3, 13.1.0.8 |
709132-1 | 3-Major | BT709132 | When the BigDB variable tmm.ssl.loggingcreatedcerts is set a buffer overflow can occur | 14.1.0, 14.0.0.3, 13.1.0.8 |
707961-2 | 3-Major | K50013510, BT707961 | Unable to add policy to virtual server; error = Failed to compile the combined policies | 14.1.0, 14.0.0.3, 13.1.0.8 |
707109-1 | 3-Major | BT707109 | Memory leak when using C3D | 14.0.0, 13.1.0.8 |
704381-5 | 3-Major | BT704381 | SSL/TLS handshake failures and terminations are logged at too low a level | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.5.1 |
702151-1 | 3-Major | BT702151 | HTTP/2 can garble large headers | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.3 |
700889-3 | 3-Major | K07330445, BT700889 | Software syncookies without TCP TS improperly include TCP options that are not encoded | 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.3 |
700061-4 | 3-Major | BT700061 | Restarting service MCPD or rebooting BIG-IP device adds 'other' file read permissions to key file | 14.0.0, 13.1.0.8, 12.1.3.6 |
699598-2 | 3-Major | BT699598 | HTTP/2 requests with large body may result in RST_STREAM with FRAME_SIZE_ERROR or TCP RST | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.5 |
696755 | 3-Major | BT696755 | HTTP/2 may truncate a response body when served from cache | 16.1.0, 16.0.1.2, 15.1.3, 14.1.0.6, 13.1.0.8 |
693308-1 | 3-Major | BT693308 | SSL Session Persistence hangs upon receipt of fragmented Client Certificate Chain | 14.0.0, 13.1.0.8, 12.1.3.7 |
689089-1 | 3-Major | BT689089 | VIPRION cluster IP reverted to 'default' (192.168.1.246) following unexpected reboot | 14.0.0, 13.1.0.8, 12.1.3.2 |
688744-1 | 3-Major | K11793920, BT688744 | LTM Policy does not correctly handle multiple datagroups | 14.0.0, 13.1.0.8 |
686890-1 | 3-Major | BT686890 | X509_EXTENSION memory blocks leak when C3D forges the certificate. | 14.0.0, 13.1.0.8 |
682944-1 | 3-Major | BT682944 | key-id missing for installed netHSM key for standby BIG-IP system in high availability (HA) setup | 14.0.0, 13.1.0.8 |
682283-2 | 3-Major | BT682283 | Malformed HTTP/2 request with invalid Content-Length value is served against RFC | 14.1.0, 14.0.0.3, 13.1.0.8 |
678872-3 | 3-Major | BT678872 | Inconsistent behavior for virtual-address and selfip on the same ip-address | 14.1.0, 13.1.0.8, 12.1.3.6 |
673399-3 | 3-Major | BT673399 | HTTP request dropped after a 401 exchange when a Websockets profile is attached to virtual server. | 14.0.0, 13.1.0.8, 12.1.3.4 |
653201-2 | 3-Major | BT653201 | Update the default CA certificate bundle file to the latest version and remove expiring certificates from it | 13.1.0.8 |
713533-2 | 4-Minor | BT713533 | list self-ip with queries does not work | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6 |
708249-2 | 4-Minor | BT708249 | nitrox_diag utility generates QKView files with 5 MB maximum file size limit | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.6, 11.6.3.2, 11.5.7 |
692095-1 | 4-Minor | K65311501, BT692095 | bigd logs monitor status unknown for FQDN Node/Pool Member | 14.0.0, 13.1.0.8, 12.1.3.2, 11.6.3.3 |
678801-4 | 4-Minor | BT678801 | WS::enabled returned empty string | 14.0.0, 13.1.0.8, 12.1.3.6 |
677958-4 | 4-Minor | BT677958 | WS::frame prepend and WS::frame append do not insert string in the right place. | 14.0.0, 13.1.0.8, 12.1.3.6 |
Performance Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
698992-1 | 3-Major | BT698992 | Performance degraded | 14.0.0, 13.1.0.8 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
713066-1 | 2-Critical | K10620131, BT713066 | Connection failure during DNS lookup to disabled nameserver can crash TMM | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
707310-2 | 2-Critical | BT707310 | DNSSEC Signed Zone Transfers of Large Zones Can Be Incomplete (missing NSEC3s and RRSIGs) | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
721895 | 3-Major | Add functionality to configure the minimum TLS version advertised and accepted by big3d (iQuery) | 14.0.0.5, 13.1.0.8, 12.1.4.1, 11.6.4, 11.5.7 | |
715448-2 | 3-Major | BT715448 | Providing LB::status with a GTM Pool name in a variable caused validation issues | 14.1.0, 14.0.0.3, 13.1.0.8, 12.1.3.7 |
710032-1 | 3-Major | BT710032 | 'No Access' error when viewing GSLB Server's virtual server that has a name indicating a partition that does not exist on that BIG-IP system. | 14.1.0, 14.0.0.3, 13.1.0.8 |
706128-2 | 3-Major | BT706128 | DNSSEC Signed Zone Transfers Can Leak Memory | 14.0.0, 13.1.0.8, 12.1.3.6 |
703545-1 | 3-Major | BT703545 | DNS::return iRule "loop" checking disabled | 14.0.0, 13.1.0.8 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
718152 | 2-Critical | K14591455, BT718152 | ASM GUI request log does not load on cluster | 13.1.0.8 |
716788-2 | 2-Critical | BT716788 | TMM may crash while response modifications are being performed within DoSL7 filter | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.7 |
713390-1 | 2-Critical | ASM Signature Update cannot be performed on hourly billing cloud instance | 14.1.0, 13.1.0.8 | |
685230-3 | 2-Critical | BT685230 | memory leak on a specific server scenario | 14.0.0, 13.1.0.8, 12.1.3.7 |
606983-2 | 2-Critical | BT606983 | ASM errors during policy import | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6 |
719459-2 | 3-Major | BT719459 | Wrong add suggestions created for already existing response URLs when differentiate HTTP and HTTPS is disabled | 14.1.0, 14.0.0.5, 13.1.0.8 |
719005-1 | 3-Major | BT719005 | Login request may arrive corrupted to the backend server after CAPTCHA or CSID mitigation | 14.1.0, 14.0.0.5, 13.1.0.8 |
717756-2 | 3-Major | BT717756 | High CPU usage from asm_config_server | 14.1.0, 14.0.0, 13.1.0.8 |
716940-2 | 3-Major | BT716940 | Traffic Learning screen graphs shows data for the last day only | 14.1.0, 14.0.0.5, 13.1.0.8 |
715128-1 | 3-Major | BT715128 | Simple mode Signature edit does not escape semicolon | 14.1.0, 14.0.0.5, 13.1.0.8 |
713282-1 | 3-Major | BT713282 | Remote logger violation_details field does not appear when virtual server has more than one remote logger | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.7 |
712362-3 | 3-Major | BT712362 | ASM stalls WebSocket frames after legitimate websockets handshake with 101 status code, but without 'Switching Protocols' reason phrase | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.6 |
711405-1 | 3-Major | K14770331, BT711405 | ASM GUI Fails to Display Policy List After Upgrade | 14.1.0, 14.0.0.5, 13.1.0.8 |
710327-1 | 3-Major | BT710327 | Remote logger message is truncated at NULL character. | 14.0.0, 13.1.0.8, 12.1.3.6 |
707147-1 | 3-Major | BT707147 | High CPU consumed by asm_config_server_rpc_handler_async.pl | 14.0.0, 13.1.0.8, 12.1.3.6 |
706845-2 | 3-Major | BT706845 | False positive illegal multipart violation | 14.1.0, 13.1.0.8, 12.1.3.6 |
706665-2 | 3-Major | BT706665 | ASM policy is modified after pabnagd restart | 14.1.0, 14.0.0, 13.1.0.8 |
704643-1 | 3-Major | BT704643 | Backslashes preceding a forward slash are mistakenly doubled in regular expression within Signature rule | 14.1.0, 14.0.1.1, 13.1.0.8 |
702008-1 | 3-Major | BT702008 | ASM REST: Missing DB Cleanup for some tables | 14.0.0, 13.1.0.8 |
700143-2 | 3-Major | BT700143 | ASM Request Logs: Cannot delete second 10,000 records of filtered event log messages | 14.0.0, 13.1.0.8, 12.1.3.2 |
691897-3 | 3-Major | BT691897 | Names of the modified cookies do not appear in the event log | 14.0.0, 13.1.0.8, 12.1.3.6 |
687759-1 | 3-Major | BT687759 | bd crash | 14.1.0.6, 14.0.0.5, 13.1.0.8, 12.1.3.6 |
686765-2 | 3-Major | BT686765 | Database cleaning failure may allow MySQL space to fill the disk entirely | 14.0.0, 13.1.0.8, 12.1.3.6 |
674256-2 | 3-Major | K60745057, BT674256 | False positive cookie hijacking violation | 15.0.0, 14.1.0, 14.0.0, 13.1.1.4, 13.1.0.8 |
675232-6 | 4-Minor | BT675232 | Cannot modify a newly created ASM policy within an iApp template implementation or TMSH CLI transaction | 14.0.0, 13.1.0.8, 12.1.3.2, 11.6.3.2 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
710315-1 | 2-Critical | BT710315 | AVR-profile might cause issues when loading a configuration or when using config sync | 14.1.0, 14.0.0, 13.1.0.8 |
698226-1 | 2-Critical | BT698226 | Filters under Security :: Reports :: DoS :: URL Latencies work incorrectly | 14.0.0, 13.1.0.8 |
696642-1 | 2-Critical | BT696642 | monpd core is sometimes created when the system is under heavy load. | 14.0.0, 13.1.0.8 |
721474-1 | 3-Major | BT721474 | AVR does not send all SSLO statistics to offbox machine. | 14.1.0, 14.0.0, 13.1.0.8 |
715110 | 3-Major | BT715110 | AVR should report 'resolutions' in module GtmWideip | 14.1.0.2, 13.1.0.8 |
712118 | 3-Major | BT712118 | AVR should report on all 'global tags' in external logs | 14.0.0, 13.1.0.8 |
706361 | 3-Major | BT706361 | IPS stats tables are empty after upgrade from 13.1.0 to 14.0.0★ | 13.1.0.8 |
696212-1 | 3-Major | BT696212 | monpd does not return data for multi-dimension query | 14.0.0, 13.1.0.8 |
648242-2 | 3-Major | K73521040, BT648242 | Administrator users unable to access all partition via TMSH for AVR reports | 16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 14.0.0.5, 13.1.0.8, 12.1.3.2 |
649161-2 | 4-Minor | K42340304, BT649161 | AVR caching mechanism not working properly | 13.1.0.8, 12.1.3.2 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
720214-1 | 2-Critical | BT720214 | NTLM Authentication might fail if Strict Update in iApp is modified | 14.1.0, 14.0.0, 13.1.0.8 |
720189-1 | 2-Critical | BT720189 | VDI settings in APM Webtop have the incorrect URL for Citrix Receiver client download | 14.1.0, 14.0.0, 13.1.0.8 |
719149-2 | 2-Critical | BT719149 | VDI plugin might hang while processing native RDP connections | 14.1.0, 14.0.0, 13.1.0.8 |
716747-2 | 2-Critical | TMM my crash while processing APM or SWG traffic | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 | |
715250-1 | 2-Critical | BT715250 | TMM crash when RPC resumes TCL event ACCESS_SESSION_CLOSED | 14.1.0, 13.1.0.8, 12.1.3.6 |
713156-1 | 2-Critical | BT713156 | AGC cannot do redeploy in Exchange and ADFS use cases | 14.1.0, 14.0.0, 13.1.0.8 |
710116-1 | 2-Critical | BT710116 | VPN clients experience packet loss/disconnection | 14.0.0, 13.1.0.8 |
694078-1 | 2-Critical | BT694078 | In rare cases, TMM may crash with high APM traffic | 14.0.0, 13.1.0.8 |
720695-1 | 3-Major | BT720695 | Export then import of APM access Profile/Policy with advanced customization is failing | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
719192 | 3-Major | BT719192 | In VPE Agent VMware View Policy shows no properties | 13.1.0.8 |
715207-3 | 3-Major | BT715207 | coapi errors while modifying per-request policy in VPE | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6 |
714961-1 | 3-Major | BT714961 | antserver creates large temporary file in /tmp directory | 14.1.0, 14.0.0, 13.1.0.8 |
714700-2 | 3-Major | BT714700 | SSO for native RDP resources is not compatible with the 'Force Updated Clients' setting of 'Encryption Oracle Remediation' Group Policy | 14.1.0, 14.0.0, 13.1.0.8 |
713111-1 | 3-Major | BT713111 | When ASM and APM are configured on the same virtual server, ASM might report some errors in its logging. | 14.1.0, 13.1.0.8 |
710305-1 | 3-Major | BT710305 | When ASM and APM are configured on the same virtual server, ASM could throw some errors in its logging. | 14.1.0, 13.1.0.8 |
709274-1 | 3-Major | BT709274 | RADIUS Accounting requests egress on different Self IP addresses than they did pre-v13.1.0 | 14.0.0, 13.1.0.8 |
699267-2 | 3-Major | BT699267 | LDAP Query may fail to resolve nested groups | 14.1.0, 13.1.0.8, 12.1.3.4, 11.6.3.3 |
658278-1 | 3-Major | BT658278 | Network Access configuration with Layered-VS does not work with Edge Client | 14.0.0, 13.1.0.8, 11.6.4 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
703515-3 | 2-Critical | K44933323, BT703515 | MRF SIP LB - Message corruption when using custom persistence key | 14.1.0, 14.0.0, 13.1.0.8, 12.1.3.6, 11.6.3.2 |
692310-2 | 3-Major | K69250459, BT692310 | ICAP modified HTTP 1.1 request/response without content-length gets "chunked" even with no body | 14.0.0, 13.1.0.8 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
677473-3 | 2-Critical | BT677473 | MCPD core is generated on multiple add/remove of Mgmt-Rules | 14.0.0, 13.1.0.8, 12.1.3.6 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
711570-3 | 3-Major | BT711570 | PEM iRule subscriber policy name query using subscriber ID, may not return applied policies | 14.1.0, 13.1.0.8, 12.1.3.6 |
663874-2 | 3-Major | K77173309, BT663874 | Off-box HSL logging does not work with PEM in SPAN mode. | 14.1.0, 13.1.0.8 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
719186-2 | 3-Major | BT719186 | Multipart/form-data requests may generate false positive 'missing strong integrity parameter' alerts | 14.1.0, 14.0.1.1, 13.1.0.8 |
716318-2 | 3-Major | BT716318 | Engine/Signatures automatic update check may fail to find/download the latest update | 14.1.0, 14.0.0.5, 13.1.0.8, 12.1.3.7 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
714334-1 | 2-Critical | BT714334 | admd stops responding and generates a core while under stress. | 14.1.0, 14.0.0.5, 13.1.0.8 |
718772-2 | 3-Major | BT718772 | The generated signature creates incorrect predicate http.unknown_header (instead of http.unknown_header_exists) | 14.1.0, 14.0.0.5, 13.1.0.8 |
718685-1 | 3-Major | BT718685 | The measured number of pending requests is two times higher than actual one | 14.1.0, 13.1.0.8 |
701288-1 | 3-Major | BT701288 | Server health significantly increases during DoSL7 TPS prevention | 14.0.0, 13.1.0.8 |
iApp Technology Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
693694-1 | 3-Major | BT693694 | tmsh::load within IApp template results in unpredicted behavior | 14.0.0, 13.1.0.8 |
Cumulative fixes from BIG-IP v13.1.0.7 that are included in this release
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
716392-1 | 1-Blocking | BT716392 | Support for 24 vCMP guests on a single 4450 blade | 14.1.0, 14.0.0.2, 13.1.0.7 |
712429 | 1-Blocking | BT712429 | Serverside packets excluded from DoS stats | 13.1.0.7 |
704552 | 3-Major | BT704552 | Support for ONAP site licensing | 15.1.0, 14.1.4.1, 14.0.0.2, 13.1.0.7 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
707100 | 2-Critical | BT707100 | Potentially fail to create user in AzureStack | 14.0.0.1, 13.1.0.7 |
706688 | 2-Critical | BT706688 | Automatically add additional certificates to BIG-IP system in C2S and IC environments | 14.1.0, 14.0.0.1, 13.1.0.7 |
709936 | 3-Major | BT709936 | Multiple NTP server/domain-searches in the DHCP lease can cause missing DNS/NTP configuration. | 14.1.0, 14.0.0.1, 13.1.0.7 |
707585-1 | 3-Major | BT707585 | Use native driver for 82599 NICs instead of UNIC | 14.1.0, 14.0.0.1, 13.1.0.7 |
703869 | 3-Major | BT703869 | Waagent updated to 2.2.21 | 14.1.0, 14.0.0.1, 13.1.0.7, 12.1.3.3 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
713273 | 2-Critical | BT713273 | BIG-IP sys db variable avr.stats.internal.maxentitiespertable resets back to default value on services restart | 14.0.0, 13.1.0.7 |
715153-1 | 3-Major | BT715153 | AVR can generate many files in /var/avr/loader folder, which might cause disk-usage problem | 14.1.0, 14.0.0, 13.1.0.7 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
716746 | 3-Major | BT716746 | Possible tmm restart when disabling single endpoint vector while attack is ongoing | 16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.0.7 |
712710 | 3-Major | BT712710 | TMM may halt and restart when threshold mode is set to stress-based mitigation | 14.1.0, 14.0.0, 13.1.0.7 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
699103-1 | 3-Major | BT699103 | tmm continuously restarts after provisioning AFM | 14.0.0, 13.1.0.7 |
Cumulative fixes from BIG-IP v13.1.0.6 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
709972-6 | CVE-2017-12613 | K52319810, BT709972 | CVE-2017-12613: APR Vulnerability | 14.0.0.3, 13.1.0.6, 12.1.3.6 |
707186-1 | CVE-2018-5514 | K45320419, BT707186 | TMM may crash while processing HTTP/2 traffic | 14.1.0, 14.0.0, 13.1.0.6 |
702232-1 | CVE-2018-5517 | K25573437, BT702232 | TMM may crash while processing FastL4 TCP traffic | 14.1.0, 14.0.0, 13.1.0.6 |
693312-1 | CVE-2018-5518 | K03165684, BT693312 | vCMPd may crash when processing bridged network traffic | 14.0.0, 13.1.0.6, 12.1.3.4 |
688516-1 | CVE-2018-5518 | K03165684, BT688516 | vCMPd may crash when processing bridged network traffic | 14.1.0, 13.1.0.6, 12.1.3.4 |
686305-1 | CVE-2018-5534 | K64552448, BT686305 | TMM may crash while processing SSL forward proxy traffic | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2, 11.6.3.2, 11.5.7 |
589233-2 | CVE-2018-5518 | K03165684 | vCMPd may crash when processing bridged network traffic | 14.0.0, 13.1.0.6 |
714369 | CVE-2018-5526 | K62201098, BT714369 | ADM may fail when processing HTTP traffic | 14.1.0, 14.0.0, 13.1.0.6 |
714350 | CVE-2018-5526 | K62201098, BT714350 | BADOS mitigation may fail | 14.1.0, 14.0.0, 13.1.0.6 |
710314-1 | CVE-2018-5537 | K94105051, BT710314 | TMM may crash while processing HTML traffic | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3.2, 11.5.7 |
706176-1 | CVE-2018-5512 | K51754851, BT706176 | TMM crash can occur when using LRO | 14.0.0, 13.1.0.6 |
706086-3 | CVE-2018-5515 | K62750376, BT706086 | PAM RADIUS authentication subsystem hardening | 14.0.0, 13.1.0.6, 12.1.3.3 |
703940-2 | CVE-2018-5530 | K45611803, BT703940 | Malformed HTTP/2 frame consumes excessive system resources | 14.1.0, 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3.2 |
699346-3 | CVE-2018-5524 | K53931245, BT699346 | NetHSM capacity reduces when handling errors | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2, 11.6.3.2 |
688011-7 | CVE-2018-5520 | K02043709, BT688011 | Dig utility does not apply best practices | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2 |
688009-7 | CVE-2018-5519 | K46121888, BT688009 | Appliance Mode TMSH hardening | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.4 |
677088-2 | CVE-2018-15321 | K01067037, BT677088 | BIG-IP tmsh vulnerability CVE-2018-15321 | 14.1.0, 14.0.0.3, 13.1.0.6, 12.1.3.6, 11.6.3.3, 11.5.7 |
708653-1 | CVE-2018-15311 | K07550539, BT708653 | TMM may crash while processing TCP traffic | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3.3, 11.5.7 |
632875-5 | CVE-2018-5516 | K37442533, BT632875 | Non-Administrator TMSH users no longer allowed to run dig | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708389 | 3-Major | BT708389 | BADOS monitoring with Grafana requires admin privilege | 14.1.0, 14.0.0.5, 13.1.0.6 |
680850-2 | 3-Major | K48342409, BT680850 | Setting zxfrd log level to debug can cause AXFR and/or IXFR failures due to high CPU and disk usage. | 14.0.0, 13.1.0.6, 12.1.3.4 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
694897-2 | 1-Blocking | BT694897 | Unsupported Copper SFP can trigger a crash on i4x00 platforms. | 14.0.0, 13.1.0.6 |
708054-1 | 2-Critical | BT708054 | Web Acceleration: TMM may crash on very large HTML files with conditional comments | 14.0.0, 13.1.0.6, 12.1.3.4 |
706305-1 | 2-Critical | BT706305 | bgpd may crash with overlapping aggregate addresses and extended-asn-cap enabled | 14.0.0, 13.1.0.6, 12.1.3.4 |
706087 | 2-Critical | BT706087 | Entry for SSL key replaced by config-sync causes tmsh load config to fail | 14.0.0, 13.1.0.6 |
703761-2 | 2-Critical | Disable DSA keys for public-key and host-based authentication in Common Criteria mode | 14.1.0, 13.1.0.6, 12.1.3.4 | |
696113-3 | 2-Critical | BT696113 | Extra IPsec reference added per crypto operation overflows connflow refcount | 14.0.0, 13.1.0.6, 12.1.3.6 |
692683-1 | 2-Critical | BT692683 | Core with /usr/bin/tmm.debug at qa_device_mgr_uninit | 14.0.0, 13.1.0.6 |
690793-1 | 2-Critical | K25263287, BT690793 | TMM may crash and dump core due to improper connflow tracking | 14.0.0, 13.1.0.6, 12.1.3.7 |
689577-3 | 2-Critical | K45800333, BT689577 | ospf6d may crash when processing specific LSAs | 14.0.0, 13.1.0.6, 12.1.3.2 |
688911-1 | 2-Critical | K94296004, BT688911 | LTM Policy GUI incorrectly shows conditions with datagroups | 14.0.0, 13.1.0.6 |
563661-1 | 2-Critical | BT563661 | Datastor may crash | 14.0.0, 13.1.0.6, 12.1.3.2, 11.6.3.3 |
704282-2 | 3-Major | BT704282 | TMM halts and restarts when calculating BWC pass rate for dynamic bwc policy | 14.0.0, 13.1.0.6, 12.1.3.6 |
703298-2 | 3-Major | BT703298 | Licensing and phonehome_upload are not using the sync'd key/certificate | 14.0.0, 13.1.0.6 |
701626-2 | 3-Major | K16465222, BT701626 | GUI resets custom Certificate Key Chain in child client SSL profile | 14.0.0, 13.1.0.6, 12.1.3.4, 11.6.3.3 |
698429-1 | 3-Major | BT698429 | Misleading log error message: Store Read invalid store addr 0x3800, len 10 | 14.0.0, 13.1.0.6, 12.1.5.3 |
693964-1 | 3-Major | BT693964 | Qkview utility may generate invalid XML in files contained in Qkview | 14.0.0, 13.1.0.6 |
691497-2 | 3-Major | BT691497 | tmsh save sys ucs <file> fails due to missing patch file in /config/.diffVersions | 14.0.0, 13.1.0.6 |
691210-1 | 3-Major | BT691210 | Traffic stops on tmm restart when guest VLAN tagging is used for BIG-IP VE. | 14.0.0, 13.1.0.6 |
687353-1 | 3-Major | K35595105, BT687353 | Qkview truncates tmstat snapshot files | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2 |
631316-2 | 3-Major | K62532020, BT631316 | Unable to load config with client-SSL profile error★ | 14.0.0, 13.1.0.6, 12.1.3.2, 11.6.3.2 |
514703-3 | 4-Minor | BT514703 | gtm listener cannot be listed across partitions | 14.0.0, 13.1.0.6, 13.0.1 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
709334-1 | 2-Critical | BT709334 | Memory leak when SSL Forward proxy is used and ssl re-negotiates | 14.0.0, 13.1.0.6, 12.1.3.6 |
708114-1 | 2-Critical | K33319853, BT708114 | TMM may crash when processing the handshake message relating to OCSP, after the SSL connection is closed | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3.2 |
707447-1 | 2-Critical | BT707447 | Default SNI clientssl profile's sni_certsn_hash can be freed while in use by other profiles. | 14.0.0, 13.1.0.6, 12.1.3.6 |
707246-1 | 2-Critical | BT707246 | TMM would crash if SSL Client profile could not load cert-key-chain successfully | 14.0.0, 13.1.0.6 |
706631-2 | 2-Critical | BT706631 | A remote TLS server certificate with a bad Subject Alternative Name should be rejected when Common Criteria mode is licensed and configured. | 14.1.0, 14.0.0, 13.1.0.6, 12.1.3.4 |
705611-2 | 2-Critical | BT705611 | The TMM may crash when under load when configuration changes occur when the HTTP/2 profile is used | 14.0.0, 13.1.0.6, 12.1.3.4 |
704666-1 | 2-Critical | BT704666 | memory corruption can occur when using certain certificates | 14.0.0, 13.1.0.6, 12.1.3.4 |
704435-1 | 2-Critical | BT704435 | Client connection may hang when NTLM and OneConnect profiles used together | 14.0.0, 13.1.0.6 |
703914-2 | 2-Critical | BT703914 | TMM SIGSEGV crash in poolmbr_conn_dec. | 14.0.0, 13.1.0.6, 12.1.3.6 |
703191-2 | 2-Critical | BT703191 | HTTP2 requests may contain invalid headers when sent to servers | 14.1.0, 14.0.0, 13.1.0.6 |
701244-1 | 2-Critical | K81742541, BT701244 | An incorrect data manipulation in cipher encrypt and decrypt could cause TMM crash with SIGABRT | 14.0.0, 13.1.0.6 |
701202-3 | 2-Critical | K35023432, BT701202 | SSL memory corruption | 14.0.0, 13.1.0.6, 12.1.3.4 |
700393-3 | 2-Critical | K53464344, BT700393 | Under certain circumstances, a stale HTTP/2 stream can cause a tmm crash | 14.1.0, 14.0.0, 13.1.0.6, 12.1.3.4, 11.6.3.3 |
697259-2 | 2-Critical | K14023450, BT697259 | Different versioned vCMP guests on the same chassis may crash. | 14.0.0, 13.1.0.6, 12.1.3.7 |
694656-1 | 2-Critical | K05186205, BT694656 | Routing changes may cause TMM to restart | 14.0.0, 13.1.0.6, 12.1.3.7 |
686228-1 | 2-Critical | K23243525, BT686228 | TMM may crash in some circumstances with VLAN failsafe | 14.0.0, 13.1.0.6, 12.1.3.2, 11.6.4, 11.5.9 |
680074-2 | 2-Critical | BT680074 | TMM crashes when serverssl cannot provide certificate to backend server. | 14.0.0, 13.1.0.6 |
667770-1 | 2-Critical | K12472293, BT667770 | SIGSEGV to tmm when performing multiple, repeated SSL profile updates, or during UCS restore | 14.0.0, 13.1.0.6 |
648320-5 | 2-Critical | K38159538, BT648320 | Downloading via APM tunnels could experience performance downgrade. | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.4, 11.6.3.2 |
705794-2 | 3-Major | BT705794 | Under certain circumstances a stale HTTP/2 stream might cause a tmm crash | 14.0.0, 13.1.0.6, 12.1.3.4, 11.6.3.3 |
701147-2 | 3-Major | K36563645, BT701147 | ProxySSL does not work properly with Extended Master Secret and OCSP | 14.0.0, 13.1.0.6 |
700057-4 | 3-Major | BT700057 | LDAP fails to initiate SSL negotiation because client cert and key associated file permissions are not preserved | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.4 |
693910-4 | 3-Major | BT693910 | Traffic Interruption for MAC Addresses Learned on Interfaces that Enter Blocked STP State (2000/4000/i2800/i4800 series) | 14.0.0, 13.1.0.6, 12.1.4 |
693244-2 | 3-Major | BT693244 | BIG-IP not sending RST for SYN,ACK packets when ASM is provisioned | 14.1.0, 14.0.0.3, 13.1.0.6 |
690042-1 | 3-Major | K43412307, BT690042 | Potential Tcl leak during iRule suspend operation | 14.0.0, 13.1.0.6, 12.1.3.4, 11.6.4 |
689561-1 | 3-Major | BT689561 | HTTPS request hangs when multiple virtual https servers shares the same ip address | 14.0.0, 13.1.0.6 |
686972-4 | 3-Major | BT686972 | The change of APM log settings will reset the SSL session cache. | 14.0.0, 13.1.0.6, 12.1.3.4 |
685615-4 | 3-Major | K24447043, BT685615 | Incorrect source mac for TCP Reset with vlangroup for host traffic | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.5.1, 11.5.6 |
677525-2 | 3-Major | BT677525 | Translucent VLAN group may use unexpected source MAC address | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3.2, 11.5.6 |
663821-1 | 3-Major | K41344010, BT663821 | SNAT Stats may not include port FTP traffic | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2 |
653976-4 | 3-Major | K00610259, BT653976 | SSL handshake fails if server certificate contains multiple CommonNames | 14.0.0, 13.1.0.6, 12.1.3.4 |
594751-1 | 3-Major | K90535529, BT594751 | LLDP VLAN Information not Transmitted to Neighbors When Interfaces are Added to a Trunk after the Trunk has Already Been Assigned to a VLAN | 14.0.0, 13.1.0.6, 12.1.5.1 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
710424-2 | 2-Critical | BT710424 | Possible SIGSEGV in GTMD when GTM persistence is enabled. | 14.1.0, 14.0.0, 13.1.0.6, 12.1.3.4, 11.6.5.2 |
678861-1 | 2-Critical | BT678861 | DNS:: namespace commands in procs cause upgrade failure when change from Link Controller license to other★ | 14.0.0, 13.1.0.6, 12.1.3.2 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
710870 | 2-Critical | BT710870 | Temporary browser challenge failure after installing older ASU | 13.1.0.6 |
711011-2 | 3-Major | BT711011 | 'API Security' security policy template changes | 14.0.0, 13.1.0.6 |
683241-1 | 3-Major | K70517410, BT683241 | Improve CSRF token handling | 14.1.0, 13.1.0.6, 12.1.3.6, 11.6.3.2, 11.5.6 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
710947-1 | 2-Critical | BT710947 | AVR does not send errdef for entity DosIpLogReporting. | 14.0.0, 13.1.0.6 |
710110-1 | 2-Critical | BT710110 | AVR does not publish DNS statistics to external log when usr-offbox is enabled. | 14.0.0, 13.1.0.6 |
711929-1 | 3-Major | BT711929 | AVR should not send statistic on hidden rows for module InterfaceTraffic and module InterfaceHealth | 14.0.0, 13.1.0.6 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
679221-2 | 1-Blocking | BT679221 | APMD may generate core file or appears locked up after APM configuration changed | 14.0.0, 13.1.0.6, 12.1.3.4 |
708005-1 | 2-Critical | K12423316, BT708005 | Users cannot use Horizon View HTML5 client to launch Horizon 7.4 resources | 14.0.0, 13.1.0.6 |
703208-1 | 2-Critical | BT703208 | PingAccessAgent causes TMM core | 14.0.0, 13.1.0.6 |
702278-2 | 2-Critical | Potential XSS security exposure on APM logon page. | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.4 | |
700522-1 | 2-Critical | BT700522 | APMD may unexpectedly restart when worker threads are stuck | 14.0.0, 13.1.0.6 |
700090-2 | 2-Critical | BT700090 | tmm crash during execution of a per-request policy when modified during execution. | 14.0.0, 13.1.0.6 |
699686-1 | 2-Critical | BT699686 | localdbmgr can occasionally crash during shutdown | 14.1.0, 14.0.0, 13.1.0.6 |
697452-1 | 2-Critical | BT697452 | Websso crashes because of bad argument in logging | 14.1.0, 13.1.0.6, 13.0.1 |
712924-1 | 3-Major | BT712924 | In VPE SecurID servers list are not being displayed in SecurID authentication dialogue | 13.1.0.6, 12.1.3.6 |
703793-3 | 3-Major | BT703793 | tmm restarts when using ACCESS::perflow get' in certain events | 14.0.0, 13.1.0.6, 12.1.3.7 |
703171-1 | 3-Major | BT703171 | High CPU usage for apmd, localdbmgr and oauth processes | 14.0.0, 13.1.0.6 |
702487-3 | 3-Major | BT702487 | AD/LDAP admins with spaces in names are not supported | 14.0.0, 13.1.0.6, 12.1.3.4 |
684937-3 | 3-Major | K26451305, BT684937 | [KERBEROS SSO] Performance of LRU cache for Kerberos tickets drops gradually with the number of users | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.6, 11.6.3.2, 11.5.6 |
683113-3 | 3-Major | K22904904, BT683113 | [KERBEROS SSO][KRB5] The performance of memory type Kerberos ticket cache in krb5 library drops gradually with the number of users | 14.1.0, 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.6, 11.6.3.2, 11.5.6 |
681415-3 | 3-Major | BT681415 | Copying of profile with advanced customization or images might fail | 14.0.0, 13.1.0.6, 12.1.3.4 |
678427-1 | 3-Major | K03138339, BT678427 | Safari 11 displays F5 EPI and F5 VPN launch confirmation dialogs twice | 14.0.0, 13.1.0.6 |
675775-4 | 3-Major | BT675775 | TMM crashes inside dynamic ACL building session db callback | 14.0.0, 13.1.0.6, 12.1.3.4 |
671597-3 | 3-Major | BT671597 | Import, export, copy and delete is taking too long on 1000 entries policy | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2 |
673717-3 | 4-Minor | BT673717 | VPE loading times can be very long | 14.0.0, 13.1.0.6, 13.0.1, 12.1.3.2 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
701889-1 | 2-Critical | BT701889 | Setting log.ivs.level or log-config filter level to informational causes crash | 14.0.0, 13.1.0.6 |
679114-4 | 3-Major | BT679114 | Persistence record expires early if an error is returned for a BYE command | 14.0.0, 13.1.0.6, 12.1.3.6, 11.6.3 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708888-1 | 2-Critical | K79814103, BT708888 | Some DNS truncated responses may not be processed by BIG-IP | 14.0.0, 13.1.0.6 |
667353 | 2-Critical | BT667353 | Intermittent TMM crash when AFM dynamic (behavioral) signature is enabled and past attack signatures incorrectly exist in the correlation stats table | 14.0.0, 13.1.0.6 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
702705-2 | 2-Critical | BT702705 | Core observed during lease query testing when RADIUS Authentication is configured in DHCP profile | 14.0.0, 13.1.0.6 |
699531-1 | 2-Critical | BT699531 | Potential TMM crash due to incorrect number of attributes in a PEM iRule command | 14.1.0, 14.0.0.3, 13.1.0.6, 12.1.3.6 |
696294-1 | 2-Critical | BT696294 | TMM core may be seen when using Application reporting with flow filter in PEM | 14.0.0, 13.1.0.6, 12.1.3.6 |
711093-1 | 3-Major | BT711093 | PEM sessions may stay in marked_for_delete state with Gx reporting and Gy enabled | 14.1.0, 14.0.0.3, 13.1.0.6, 12.1.3.6 |
709610-3 | 3-Major | BT709610 | Subscriber session creation via PEM may fail due to a RADIUS-message-triggered race condition in PEM | 14.1.0, 14.0.0.3, 13.1.0.6, 12.1.3.6 |
697718-1 | 3-Major | BT697718 | Increase PEM HSL reporting buffer size to 4K. | 14.0.0, 13.1.0.6, 12.1.3.6 |
677494-1 | 3-Major | BT677494 | Flow filter with Periodic content insertion action could leak insert content record | 14.0.0, 13.1.0.6 |
677148-1 | 3-Major | BT677148 | Periodic content insertion creates duplicate records if same policy is added to Global high and subscriber specific | 14.0.0, 13.1.0.6 |
676346-2 | 3-Major | BT676346 | PEM displays incorrect policy action counters when the gate status is disabled. | 14.1.0, 14.0.0.3, 13.1.0.6 |
648802-1 | 3-Major | BT648802 | Required custom AVPs are not included in an RAA when reporting an error. | 14.1.0, 14.0.0.3, 13.1.0.6, 12.1.3.6 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
710701-1 | 3-Major | BT710701 | "Application Layer Encryption" option is not saved in DataSafe GUI | 14.0.0, 13.1.0.6 |
709319-2 | 3-Major | BT709319 | Post-login client-side alerts are missing username in bigIQ | 14.0.0, 13.1.0.6 |
706835 | 3-Major | BT706835 | When cloning a profile, URL parameters are not shown | 13.1.0.6 |
706771-1 | 3-Major | BT706771 | FPS ajax-mapping property may be set even when it should be blocked | 14.0.0, 13.1.0.6 |
706651-1 | 3-Major | BT706651 | Cloning URL does not clone "Description" field | 14.0.0, 13.1.0.6 |
706276-1 | 4-Minor | BT706276 | Unnecessary pop-up appears | 13.1.0.6 |
Device Management Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708305-2 | 3-Major | BT708305 | Discover task may get stuck in CHECK_IS_ACTIVE step | 14.0.0, 13.1.0.6 |
705593-5 | 4-Minor | CVE-2015-7940: Bouncy Castle Java Vulnerability | 14.1.0, 14.0.0, 13.1.0.6 |
Cumulative fixes from BIG-IP v13.1.0.5 that are included in this release
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
633441-1 | 3-Major | BT633441 | Datasync Background Tasks running even without features requiring it | 14.0.0, 13.1.0.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708189 | 4-Minor | BT708189 | OAuth Discovery Auto Pilot is implemented | 13.1.0.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
708840 | 3-Major | BT708840 | 13.0.0-to-13.1.0 upgrade operation on VIPRION 2250 blades might fail if global whitelist is configured | 14.0.0, 13.1.0.5 |
Cumulative fixes from BIG-IP v13.1.0.4 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
705161-1 | CVE-2018-5505 | K23520761, BT705161 | BIG-IP ASM and BIG-IP AFM/BIG-IP Analytics vulnerability CVE-2018-5505 | 14.0.0, 13.1.0.4 |
703517 | CVE-2018-5505 | K23520761, BT703517 | BIG-IP ASM and BIG-IP AFM/BIG-IP Analytics vulnerability CVE-2018-5505 | 13.1.0.4 |
700556-1 | CVE-2018-5504 | K11718033, BT700556 | TMM may crash when processing WebSockets data | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
699012-1 | CVE-2018-5502 | K43121447, BT699012 | TMM may crash when processing SSL/TLS data | 14.0.0, 13.1.0.4, 13.0.1 |
698080-3 | CVE-2018-5503 | K54562183, BT698080 | TMM may consume excessive resources when processing with PEM | 14.1.0, 14.0.0, 13.1.0.4, 12.1.3.2 |
695901-1 | CVE-2018-5513 | K46940010, BT695901 | TMM may crash when processing ProxySSL data | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.4, 11.6.3.2, 11.5.6 |
691504-1 | CVE-2018-5503 | K54562183, BT691504 | PEM content insertion in a compressed response may cause a crash. | 14.0.0, 13.1.0.4, 12.1.3.2 |
704580-1 | CVE-2018-5549 | K05018525, BT704580 | apmd service may restart when BIG-IP is used as SAML SP while processing response from SAML IdP | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.4, 11.6.3.2 |
701447-1 | CVE-2017-5754 | K91229003, BT701447 | CVE-2017-5754 (Meltdown) | 14.0.0, 13.1.0.4, 13.0.1 |
701445-1 | CVE-2017-5753 CVE-2017-9074 CVE-2017-7542 CVE-2017-11176 |
K91229003, BT701445 | CVE-2017-5753 (Spectre Variant 1) | 14.0.0, 13.1.0.4, 13.0.1 |
701359-4 | CVE-2017-3145 | K08613310 | BIND vulnerability CVE-2017-3145 | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.4, 11.6.3.2 |
699455-4 | CVE-2018-5523 | K50254952, BT699455 | SAML export does not follow best practices | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3.2, 11.5.6 |
699451-3 | CVE-2018-5511 | K30500703, BT699451 | OAuth reports do not follow best practices | 14.0.0, 13.1.0.4, 13.0.1 |
676457-5 | CVE-2017-6153 | K52167636, BT676457 | TMM may consume excessive resource when processing compressed data | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3.2, 11.5.6 |
640766-2 | CVE-2016-10088 CVE-2016-9576 |
K05513373, BT640766 | Linux kernel vulnerability: CVE-2016-10088 CVE-2016-9576 | 14.0.0, 13.1.0.4, 13.0.1 |
636986-1 | CVE-2021-22982 | K72708443, BT636986 | big3d agent vulnerability CVE-2021-22982 | 14.0.0, 13.1.0.4 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
686389-1 | 3-Major | BT686389 | APM does not honor per-farm HTML5 client disabling at the View Connection Server | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
678524-1 | 3-Major | BT678524 | Join FF02::2 multicast group when router-advertisement is configured | 14.0.0, 13.1.0.4 |
693007-1 | 4-Minor | BT693007 | Modify b.root-servers.net IPv4 address 192.228.79.201 to 199.9.14.201 according to InterNIC | 14.0.0, 13.1.0.4, 12.1.3.6 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
707226 | 1-Blocking | BT707226 | DB variables to disable CVE-2017-5754 Meltdown/PTI mitigations | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.3, 11.6.3.1, 11.5.6 |
700315-2 | 1-Blocking | K26130444, BT700315 | Ctrl+C does not terminate TShark | 14.1.0, 14.0.0, 13.1.0.4, 12.1.3.6 |
667148-3 | 1-Blocking | K02500042, BT667148 | Config load or upgrade can fail when loading GTM objects from a non-/Common partition | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
706998-3 | 2-Critical | BT706998 | Memory leak when OCSP is configured in clientSSL profile for C3D, or in serverSSL profile for server authentication | 14.0.0, 13.1.0.4 |
692890-3 | 2-Critical | BT692890 | Adding support for BIG-IP 800 in 13.1.x | 14.1.0, 14.0.0, 13.1.0.4 |
685458-7 | 2-Critical | K44738140, BT685458 | merged fails merging a table when a table row has incomplete keys defined. | 14.0.0, 13.1.0.4, 12.1.5 |
665354-1 | 2-Critical | K31190471, BT665354 | Silent reboot, identified with bad_tlp_status and completion_time_out in the sel log | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3 |
703848-1 | 3-Major | BT703848 | Possible memory leak when reusing statistics rows in tables | 14.0.0, 13.1.0.4, 13.0.1 |
702520-2 | 3-Major | K53330514, BT702520 | Same AZ failover in AWS fails in some configurations with two or more objects sharing the same IP address. | 14.0.0, 13.1.0.4 |
694740-3 | 3-Major | BT694740 | BIG-IP reboot during a TMM core results in an incomplete core dump | 14.0.0, 13.1.0.4, 12.1.3.6 |
692753-1 | 3-Major | BT692753 | shutting down trap not sent when shutdown -r or shutdown -h issued from shell | 14.1.0, 14.0.0, 13.1.0.4 |
689691-2 | 3-Major | BT689691 | iStats line length greater than 4032 bytes results in corrupted statistics or merge errors | 14.0.0, 13.1.0.4, 13.0.1 |
686029-2 | 3-Major | BT686029 | A VLAN delete can result in unrelated VLAN FDB entries being flushed on shared VLAN member interfaces | 14.0.0, 13.1.0.4, 12.1.3.4 |
669462-2 | 3-Major | BT669462 | Error adding /Common/WideIPs as members to GTM Pool in non-Common partition | 14.0.0, 13.1.0.4, 12.1.3.2 |
589083-6 | 3-Major | BT589083 | TMSH and iControl REST: When logged in as a remote user who has the admin role, cannot save config because of permission errors. | 14.1.0, 14.0.0, 13.1.0.4, 12.1.2 |
699281-1 | 4-Minor | BT699281 | Version format of hypervisor bundle matches Version format of ISO | 14.0.0, 13.1.0.4, 12.1.3.2 |
685475-1 | 4-Minor | K93145012, BT685475 | Unexpected error when applying hotfix | 14.0.0, 13.1.0.4, 12.1.3.6 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
706534-1 | 1-Blocking | BT706534 | L7 connection mirroring may not be fully mirrored on standby BIG-IP system | 14.0.0, 13.1.0.4 |
698424-1 | 1-Blocking | K11906514, BT698424 | Traffic over a QinQ VLAN (double tagged) will not pass | 14.0.0, 13.1.0.4 |
700862-1 | 2-Critical | K15130240, BT700862 | tmm SIGFPE 'valid node' | 14.0.0, 13.1.0.4, 12.1.3.4 |
699298-2 | 2-Critical | BT699298 | 13.0.0 Hotfix HF3 3.0.1679 TMM CORED due to SIGSEGV. | 14.0.0, 13.1.0.4, 13.0.1 |
698461-1 | 2-Critical | BT698461 | Tmm may crash in fastl4 TCP | 14.0.0, 13.1.0.4 |
692970-2 | 2-Critical | BT692970 | Using UDP port 67 for purposes other than DHCP might cause TMM to crash | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
691095-1 | 2-Critical | BT691095 | CA bundle manager loses certificates in the CA bundle if the serial number is longer than 4 bytes | 14.0.0, 13.1.0.4 |
687635-1 | 2-Critical | K58002142, BT687635 | Tmm becomes unresponsive and might restart | 14.0.0, 13.1.0.4, 13.0.1 |
687205-2 | 2-Critical | BT687205 | Delivery of HUDEVT_SENT messages at shutdown by SSL may cause tmm restart | 14.0.0, 13.1.0.4, 12.1.3.4 |
681175-3 | 2-Critical | K32153360, BT681175 | TMM may crash during routing updates | 14.0.0, 13.1.0.4, 12.1.3.2 |
674576-3 | 2-Critical | BT674576 | Outage may occur with VIP-VIP configurations | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
452283-5 | 2-Critical | BT452283 | An MPTCP connection that receives an MP_FASTCLOSE might not clean up its flows | 14.0.0, 13.1.0.4, 12.1.3.4, 11.6.3.3 |
440620-1 | 2-Critical | BT440620 | New connections may be reset when a client reuses the same port as it used for a recently closed connection | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.5.1 |
704073-1 | 3-Major | K24233427, BT704073 | Repeated 'bad transition' OOPS logging may appear in /var/log/ltm and /var/log/tmm | 14.0.0, 13.1.0.4, 12.1.3.2 |
702439 | 3-Major | K04964898, BT702439 | Non-default HTTP/2 header_table_size causes HTTP/2 streams to be reset | 14.1.0, 14.0.0, 13.1.0.4 |
698916-1 | 3-Major | BT698916 | TMM crash with HTTP/2 under specific condition | 14.0.0, 13.1.0.4, 12.1.3.6 |
698379-2 | 3-Major | K61238215, BT698379 | HTTP2 upload intermittently is aborted with HTTP2 error error_code=FLOW_CONTROL_ERROR( | 14.1.0, 13.1.0.4, 12.1.3.6 |
698000-3 | 3-Major | K04473510, BT698000 | Connections may stop passing traffic after a route update | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3 |
695707-5 | 3-Major | BT695707 | BIG-IP does not retransmit DATA_FIN when closing an MPTCP connection | 14.0.0, 13.1.0.4 |
691806-1 | 3-Major | K61815412, BT691806 | RFC 793 - behavior receiving FIN/ACK in SYN-RECEIVED state | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.3.3, 11.5.7 |
689449-1 | 3-Major | BT689449 | Some flows may remain indefinitely in memory with spdy/http2 and http fallback-host configured | 14.0.0, 13.1.0.4, 12.1.3.4, 11.6.4 |
688571-2 | 3-Major | K40332712, BT688571 | Untrusted cert might be accepted by the server-ssl even though when 'untrusted-cert-response-control drop' is configured in the server-ssl profile. | 14.0.0, 13.1.0.4 |
688570-5 | 3-Major | BT688570 | BIG-IP occasionally sends MP_FASTCLOSE after an MPTCP connection close completes | 14.0.0, 13.1.0.4 |
686307-3 | 3-Major | K10665315, BT686307 | Monitor Escaping is not changed when upgrading from 11.6.x to 12.x and later | 14.0.0, 13.1.0.4, 12.1.3.2 |
686065-2 | 3-Major | BT686065 | RESOLV::lookup iRule command can trigger crash with slow resolver | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
682104-3 | 3-Major | BT682104 | HTTP PSM leaks memory when looking up evasion descriptions | 14.0.0, 13.1.0.4, 12.1.3.2 |
680264-2 | 3-Major | BT680264 | HTTP2 headers frame decoding may fail when the frame delivered in multiple xfrags | 14.0.0, 13.1.0.4, 13.0.1, 12.1.4 |
677666-2 | 3-Major | BT677666 | /var/tmstat/blades/scripts segment grows in size. | 14.0.0, 13.1.0.4, 13.0.1 |
664528-2 | 3-Major | K53282793, BT664528 | SSL record can be larger than maximum fragment size (16384 bytes) | 14.0.0, 13.1.0.4, 12.1.3.4 |
251162-1 | 3-Major | K11564 | The error message 'HTTP header exceeded maximum allowed size' may list the wrong profile name | 14.0.0, 13.1.0.4, 12.1.3.6 |
685467-1 | 4-Minor | K12933087, BT685467 | Certain header manipulations in HTTP profile may result in losing connection. | 14.0.0, 13.1.0.4, 12.1.3.6 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
699135-1 | 2-Critical | BT699135 | tmm cores with SIGSEGV in dns_rebuild_response while using host command for not A/AAAA wideip | 14.0.0, 13.1.0.4, 12.1.3.4 |
692941-1 | 2-Critical | BT692941 | GTMD and TMM SIGSEGV when changing wide IP pool in GTMD | 14.0.0, 13.1.0.4, 12.1.3.2, 11.5.9 |
691287-1 | 2-Critical | BT691287 | tmm crashes on iRule with GTM pool command | 14.0.0, 13.1.0.4, 12.1.3.4 |
682335-1 | 2-Critical | BT682335 | TMM can establish multiple connections to the same gtmd | 14.0.0, 13.1.0.4, 12.1.3.4 |
580537-3 | 2-Critical | BT580537 | The GeoIP update script geoip_update_data cannot be used to install City2 GeoIP data | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
562921-5 | 2-Critical | BT562921 | Cipher 3DES and iQuery encrypting traffic between BIG-IP systems | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3.2, 11.5.6 |
705503-3 | 3-Major | BT705503 | Context leaked from iRule DNS lookup | 14.0.0, 13.1.0.4, 12.1.3.6 |
703702 | 3-Major | BT703702 | Fixed iControl REST not listing GTM Listeners | 13.1.0.4 |
700527-3 | 3-Major | BT700527 | cmp-hash change can cause repeated iRule DNS-lookup hang | 14.0.0, 13.1.0.4, 12.1.3.2 |
699339-3 | 3-Major | K24634702, BT699339 | Geolocation upgrade files fail to replicate to secondary blades | 14.0.0, 13.1.0.4, 12.1.3.4 |
696808-1 | 3-Major | BT696808 | Disabling a single pool member removes all GTM persistence records | 14.0.0, 13.1.0.4, 12.1.3.4 |
691498-3 | 3-Major | BT691498 | Connection failure during iRule DNS lookup can crash TMM | 14.0.0, 13.1.0.4, 12.1.3.2 |
690166-1 | 3-Major | BT690166 | ZoneRunner create new stub zone when creating a SRV WIP with more subdomains | 14.0.0, 13.1.0.4, 12.1.3.2 |
687128-1 | 3-Major | BT687128 | gtm::host iRule validation for ipv4 and ipv6 addresses | 14.0.0, 13.1.0.4, 12.1.3.4 |
680069-1 | 3-Major | K81834254, BT680069 | zxfrd core during transfer while network failure and DNS server removed from DNS zone config★ | 14.0.0, 13.1.0.4, 12.1.3.6 |
679149-1 | 3-Major | BT679149 | TMM may crash or LB::server returns unexpected result due to reused lb_result->pmbr[0] | 14.0.0, 13.1.0.4, 12.1.3.4 |
667469-3 | 3-Major | K35324588, BT667469 | Higher than expected CPU usage when using DNS Cache | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
636997-1 | 4-Minor | big3d may crash | 14.0.0, 13.1.0.4 | |
636994-1 | 4-Minor | big3d may crash | 14.0.0, 13.1.0.4 | |
636992-1 | 4-Minor | big3d may crash | 14.0.0, 13.1.0.4 | |
636982-1 | 4-Minor | big3d may crash | 14.0.0, 13.1.0.4 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
705774-1 | 3-Major | BT705774 | Add a set of disallowed file types to RDP template | 14.0.0, 13.1.0.4 |
703833-1 | 3-Major | BT703833 | Some bot detected features might not work as expected on Single Page Applications | 14.0.0, 13.1.0.4 |
702946-3 | 3-Major | BT702946 | Added option to reset staging period for signatures | 15.1.0, 14.0.0, 13.1.0.4, 12.1.3.2 |
701841-2 | 3-Major | BT701841 | Unnecessary file recovery_db/conf.tar.gz consumes /var disk space | 14.0.0, 13.1.0.4, 12.1.3.2 |
701327-2 | 3-Major | BT701327 | failed configuration deletion may cause unwanted bd exit | 14.0.0, 13.1.0.4, 12.1.3.2 |
700812-1 | 3-Major | BT700812 | asmrepro recognizes a BIG-IP version of 13.1.0.1 as 13.1.0 and fails to load a qkview | 13.1.0.4, 12.1.3.6 |
700726-2 | 3-Major | BT700726 | Search engine list was updated, and fixing case of multiple entries | 14.0.0, 13.1.0.4, 12.1.3.6 |
698919-3 | 3-Major | BT698919 | Anti virus false positive detection on long XML uploads | 14.0.0, 13.1.0.4, 12.1.3.2 |
697756-1 | 3-Major | BT697756 | Policy with CSRF URL parameter cannot be imported as binary policy file | 14.0.0, 13.1.0.4 |
697303-1 | 3-Major | BT697303 | BD crash | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3.2, 11.5.6 |
696265-5 | 3-Major | K60985582, BT696265 | BD crash | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3.2, 11.5.6 |
696073-2 | 3-Major | BT696073 | BD core on a specific scenario | 14.0.0, 13.1.0.4 |
695563-1 | 3-Major | Improve speed of ASM initialization on first startup | 14.0.0, 13.1.0.4 | |
694922-5 | 3-Major | BT694922 | ASM Auto-Sync Device Group Does Not Sync | 14.0.0, 13.1.0.4, 12.1.3.2, 11.6.3.2, 11.5.6 |
693780-1 | 3-Major | BT693780 | Proactive Bot Defense sends CAPTCHA to the UC browser on iOS devices | 14.0.0, 13.1.0.4 |
693663-1 | 3-Major | BT693663 | Proactive Bot Defense sends CAPTCHA to the Firefox browser on iOS only in desktop mode | 14.0.0, 13.1.0.4 |
691477-2 | 3-Major | BT691477 | ASM standby unit showing future date and high version count for ASM Device Group | 14.0.0, 13.1.0.4, 12.1.3.2 |
679384-3 | 3-Major | K85153939, BT679384 | The policy builder is not getting updates about the newly added signatures. | 14.0.0, 13.1.0.4, 12.1.3.2 |
678293-2 | 3-Major | K25066531, BT678293 | Uncleaned policy history files cause /var disk exhaustion | 14.0.0, 13.1.0.4, 12.1.3.2 |
665992-2 | 3-Major | K40510140, BT665992 | Live Update via Proxy No Longer Works | 14.0.0, 13.1.0.4 |
608988-1 | 3-Major | BT608988 | Error when deleting multiple ASM Policies | 14.0.0, 13.1.0.4 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
703233 | 3-Major | BT703233 | Some filters don't work in Security->Reporting->URL Latencies page | 13.1.0.4 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
707676-1 | 2-Critical | BT707676 | Memory leak in Machine Certificate Check agent of the apmd process | 14.0.0, 13.1.0.4 |
700724-2 | 2-Critical | BT700724 | Client connection with large number of HTTP requests may cause tmm to restart | 14.0.0, 13.1.0.4, 13.0.1 |
692557-1 | 2-Critical | BT692557 | When BIG-IP as SAML IdP processes signed authentication requests from external SAML SP, a block of memory may become corrupted. | 14.0.0, 13.1.0.4, 13.0.1 |
690116-1 | 2-Critical | BT690116 | websso daemon might crash when logging set to debug | 14.0.0, 13.1.0.4 |
689591-2 | 2-Critical | BT689591 | When pingaccess SDK processes certain POST requests from the client, the TMM may restart | 14.0.0, 13.1.0.4, 13.0.1 |
677368-2 | 2-Critical | BT677368 | Websso crash due to uninitialized member in websso context object while processing a log message | 14.0.0, 13.1.0.4, 13.0.1 |
631286-3 | 2-Critical | BT631286 | TMM Memory leak caused by APM URI cache entries | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.7 |
703429-2 | 3-Major | BT703429 | Citrix Receiver for Android (v3.13.1) crashes while accessing PNAgent services | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
702263-1 | 3-Major | BT702263 | An access profile with large number of SAML Resources (greater than 200) causes APM error ERR_TOOBIG while loading. | 14.0.0, 13.1.0.4 |
702222-1 | 3-Major | BT702222 | RADIUS and SecurID Auth fails with empty password | 14.0.0, 13.1.0.4 |
701740-1 | 3-Major | BT701740 | apmd leaks memory when updating Access V2 policy | 14.0.0, 13.1.0.4 |
701737-1 | 3-Major | BT701737 | apmd may leak memory on destroying Kerberos cache | 14.0.0, 13.1.0.4 |
701736-1 | 3-Major | BT701736 | Memory leak in Machine Certificate Check agent of the apmd process | 14.0.0, 13.1.0.4 |
701639-1 | 3-Major | BT701639 | Session variables in Requested Authentication Context Class in SP do not get resolved when Authentication Request is generated by BIG-IP as SP. | 14.0.0, 13.1.0.4 |
697636-3 | 3-Major | BT697636 | ACCESS is not replacing headers while replacing POST body | 14.0.0, 13.1.0.4, 13.0.1 |
695953-1 | 3-Major | BT695953 | Custom URL Filter object is missing after load sys config TMSH command | 14.0.0, 13.1.0.4, 13.0.1 |
694624-1 | 3-Major | BT694624 | SSO enabled Native RDP resources can't be accessed via hardware BIG-IP with "Intel Cave Creek" coprocessor | 14.0.0, 13.1.0.4, 13.0.1 |
693844-1 | 3-Major | K58335157, BT693844 | APMD may restart continuously and cannot come up | 13.1.0.4 |
692307-3 | 3-Major | BT692307 | User with 'operator' role may not be able to view some session variables | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
687937-1 | 3-Major | BT687937 | RDP URIs generated by APM Webtop are not properly encoded | 14.0.0, 13.1.0.4 |
685862-1 | 3-Major | BT685862 | BIG-IP as SAML IdP/SP may include last x509 certificate found in the configured bundle in signed SAML Response or single logout message | 14.0.0, 13.1.0.4, 12.1.5.1 |
684583-1 | 3-Major | BT684583 | Buitin Okta Scopes Request object uses client -id and client-secret | 14.0.0, 13.1.0.4 |
684325-1 | 3-Major | BT684325 | APMD Memory leak when applying a specific access profile | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
683389-3 | 3-Major | BT683389 | Error #2134 when attempting to create local flash.net::SharedObject in rewritten ActionScript 3 file | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
683297-2 | 3-Major | BT683297 | Portal Access may use incorrect back-end for resources referenced by CSS | 14.0.0, 13.1.0.4, 13.0.1 |
682500-2 | 3-Major | BT682500 | VDI Profile and Storefront Portal Access resource do not work together | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
678851-3 | 3-Major | BT678851 | Portal Access produces incorrect Java bytecode when rewriting java.applet.AppletStub.getDocumentBase() | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
675866-4 | 3-Major | BT675866 | WebSSO: Kerberos rejects tickets with 2 minutes left in their ticket lifetime, causing APM to disable SSO | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
671627-3 | 3-Major | K06424790, BT671627 | HTTP responces without body may contain chunked body with empty payload being processed by Portal Access. | 14.0.0, 13.1.0.4, 12.1.3.2 |
632646-1 | 3-Major | BT632646 | APM - OAM login with ObSSOCookie results in error page instead of redirecting to login page, when session cookie (ObSSOCookie) is deleted from OAM server. | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3.2 |
629334-1 | 3-Major | BT629334 | Portal Access: JavaScript expressions in parentheses may be rewritten incorrectly | 14.0.0, 13.1.0.4 |
612792-1 | 3-Major | BT612792 | Support RDP redirection for connections launched from APM Webtop on iOS | 14.0.0, 13.1.0.4, 13.0.1 |
612118-2 | 3-Major | BT612118 | Nexthop explicit proxy is not used for the very first connection to communicate with the backend. | 14.0.0, 13.1.0.4, 13.0.1 |
536831-1 | 3-Major | BT536831 | APM PAM module does not handle local-only users list correctly | 14.0.0, 13.1.0.4 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
698338-1 | 2-Critical | BT698338 | Potential core in MRF occurs when pending egress messages are queued and an iRule error aborts the connection | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.5.2 |
689343-2 | 2-Critical | BT689343 | Diameter persistence entries with bi-directional flag created with 10 sec timeout | 14.0.0, 13.1.0.4 |
685708-4 | 2-Critical | BT685708 | Routing via iRule to a host without providing a transport from a transport-config created connection cores | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.3.2 |
700571-4 | 3-Major | BT700571 | SIP MR profile, setting incorrect branch param for CANCEL to INVITE | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.3.2 |
696049-1 | 3-Major | BT696049 | High CPU load on generic message if multiple responses arrive while asynchronous Tcl command is running | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.3.2, 11.5.6 |
674747-4 | 3-Major | K30837366, BT674747 | sipdb cannot delete custom bidirectional persistence entries. | 14.0.0, 13.1.0.4, 12.1.3.6, 11.6.3 |
656901-3 | 3-Major | BT656901 | MRF add 'existing_connection_only' and 'outgoing_connection_instance_seed' two iRule commands | 14.0.0, 13.1.0.4 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
704207-1 | 2-Critical | BT704207 | DNS query name is not showing up in DNS AVR reporting | 14.0.0, 13.1.0.4 |
692328-1 | 2-Critical | BT692328 | Tmm core due to incorrect memory allocation | 14.0.0, 13.1.0.4 |
703959 | 3-Major | BT703959 | Manual thresholds for DoS Protection Dynamic Signatures are not accepted via TMUI | 13.1.0.4 |
631418-1 | 3-Major | BT631418 | Packets dropped by HW grey list may not be counted toward AVR. | 14.0.0, 13.1.0.4 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
696383-1 | 2-Critical | BT696383 | PEM Diameter incomplete flow crashes when sweeped | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
694717-1 | 2-Critical | BT694717 | Potential memory leak and TMM crash due to a PEM iRule command resulting in a remote lookup. | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
616008-1 | 2-Critical | K23164003, BT616008 | TMM core may be seen when using an HSL format script for HSL reporting in PEM | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
696789-1 | 3-Major | BT696789 | PEM Diameter incomplete flow crashes when TCL resumed | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
695968-1 | 3-Major | BT695968 | Memory leak in case of a PEM Diameter session going down due to remote end point connectivity issues. | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
694319-1 | 3-Major | BT694319 | CCA without a request type AVP cannot be tracked in PEM. | 14.0.0, 13.1.0.4, 12.1.3.2 |
694318-1 | 3-Major | BT694318 | PEM subscriber sessions will not be deleted if a CCA-t contains a DIAMETER_TOO_BUSY return code and no request type AVP. | 14.0.0, 13.1.0.4, 12.1.3.2 |
684333-1 | 3-Major | BT684333 | PEM session created by Gx may get deleted across HA multiple switchover with CLI command | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
678820-1 | 3-Major | BT678820 | Potential memory leak if PEM Diameter sessions are not created successfully. | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2 |
642068-4 | 3-Major | BT642068 | PEM: Gx sessions will stay in marked_for_delete state if CCR-T timeout happens | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
624231-4 | 3-Major | BT624231 | No flow control when using content-insertion with compression | 14.0.0, 13.1.0.4, 12.1.3.2 |
680729-1 | 4-Minor | K64307999, BT680729 | DHCP Trace log incorrectly marked as an Error log. | 14.0.0, 13.1.0.4, 13.0.1, 12.1.3.2, 11.6.3 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
697363-1 | 2-Critical | BT697363 | FPS should forward all XFF header values | 14.0.0, 13.1.0.4 |
705559-1 | 3-Major | BT705559 | FPS: false positive "no strong integrity param" when none of the configured data-integrity params are present in request | 14.0.0, 13.1.0.4 |
662311-1 | 3-Major | BT662311 | CS alerts should contain actual client IP address in XFF header | 14.0.0, 13.1.0.4 |
Protocol Inspection Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
671716-1 | 3-Major | BT671716 | UCS version check was too strict for IPS hitless upgrade | 14.0.0, 13.1.0.4 |
Cumulative fixes from BIG-IP v13.1.0.3 that are included in this release
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
702419 | 3-Major | BT702419 | Protocol Inspection needs add-on license to work | 14.0.0, 13.1.0.3 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
660239-6 | 4-Minor | BT660239 | When accessing the dashboard, invalid HTTP headers may be present | 14.0.0, 13.1.0.3, 13.0.1, 12.1.3.2, 11.6.3.3, 11.5.7 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
677919-4 | 3-Major | BT677919 | Enhanced Data Manipulation AJAX Support | 14.0.0, 13.1.0.3 |
Cumulative fixes from BIG-IP v13.1.0.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
681955-1 | CVE-2017-3167 CVE-2017-3169 CVE-2017-7679 CVE-2017-9788 | K23565223, BT681955 | Apache CVE-2017-9788 | 14.0.0, 13.1.0.2 |
673595-9 | CVE-2017-3167 CVE-2017-3169 | K34125394 | Apache CVE-2017-3167 | 14.0.0, 13.1.0.2, 13.1.0, 13.0.1, 12.1.3.2, 12.1.3.1 |
694274-1 | CVE-2017-3167 CVE-2017-3169 CVE-2017-7679 CVE-2017-9788 CVE-2017-9798 | K23565223, BT694274 | [RHSA-2017:3195-01] Important: httpd security update - EL6.7 | 14.0.0, 13.1.0.2, 13.0.1, 12.1.3.2 |
672124-6 | CVE-2018-5541 | K12403422, BT672124 | Excessive resource usage when BD is processing requests | 14.0.0, 13.1.0.2, 12.1.3.6, 11.6.3.2, 11.5.6 |
679861 | CVE-2019-6655 | K31152411, BT679861 | Weak Access Restrictions on the AVR Reporting Interface | 14.0.0, 13.1.0.2, 12.1.5, 11.6.5, 11.5.10 |
673607-9 | CVE-2017-3169 | K83043359 | Apache CVE-2017-3169 | 14.0.0, 13.1.0.2, 13.1.0, 13.0.1, 12.1.3.2 |
672667-6 | CVE-2017-7679 | K75429050, BT672667 | CVE-2017-7679: Apache vulnerability | 14.0.0, 13.1.0.2, 13.0.1, 12.1.3.2 |
641101-7 | CVE-2016-8743 | K00373024 | httpd security and bug fix update CVE-2016-8743 | 14.1.0, 14.0.0, 13.1.0.2 |
684033-3 | CVE-2017-9798 | K70084351, BT684033 | CVE-2017-9798 : Apache Vulnerability (OptionsBleed) | 14.0.0, 13.1.0.2, 13.0.1, 12.1.3.2 |
661939-2 | CVE-2017-2647 | K32115847, BT661939 | Linux kernel vulnerability CVE-2017-2647 | 14.0.0, 13.1.0.2 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
685056 | 3-Major | BT685056 | VE OVAs is not the supported platform to run VMware guest OS customization | 14.0.0, 13.1.0.2 |
670103-1 | 3-Major | BT670103 | No way to query logins to BIG-IP in TMUI | 14.0.0, 13.1.0.2 |
681385-2 | 4-Minor | Forward proxy forged cert lifespan can be configured from days into hours. | 14.0.0, 13.1.0.2 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
700247 | 2-Critical | K60053504, BT700247 | APM Client Software may be missing after doing fresh install of BIG-IP VE | 14.0.0, 13.1.0.2 |
693979 | 3-Major | BT693979 | Autoscale is not functional because of the change in file permission of the /shared/vadc/aws/iid-document document | 14.0.0, 13.1.0.2 |
683131-1 | 3-Major | BT683131 | Hotfix install fails on vCMP guest when both guest and host have the same base version ISO present★ | 14.0.0, 13.1.0.2 |
682213-1 | 3-Major | K31623549, BT682213 | TLS v1.2 support in IP reputation daemon | 14.0.0, 13.1.0.2, 12.1.3.2 |
669585-1 | 3-Major | BT669585 | The tmsh sys log filter is unable to display information in uncompressed log files. | 14.1.0, 14.0.0, 13.1.0.2 |
668826-1 | 3-Major | BT668826 | File named /root/.ssh/bigip.a.k.bak is present but should not be | 14.0.0, 13.1.0.2 |
668276-1 | 3-Major | BT668276 | BIG-IP does not display failed login attempts since last login in GUI | 14.0.0, 13.1.0.2 |
668273-1 | 3-Major | K12541531, BT668273 | Logout button not available in Configuration Utility when using Client Cert LDAP | 14.0.0, 13.1.0.2 |
471237-4 | 3-Major | K12155235, BT471237 | BIG-IP VE instances do not work with an encrypted disk in AWS. | 14.0.0, 13.1.0.2, 12.1.3.2 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
699624-1 | 2-Critical | BT699624 | Config with custom 'SIP' or 'Firepass' monitor fails to load after upgrade★ | 14.1.0, 13.1.0.2 |
463097-5 | 3-Major | BT463097 | Clock advanced messages with large amount of data maintained in DNS Express zones | 14.0.0, 13.1.0.2, 12.1.3.1 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
672504-2 | 2-Critical | K52325625, BT672504 | Deleting zones from large databases can take excessive amounts of time. | 14.0.0, 13.1.0.2, 12.1.3.1 |
667542-6 | 2-Critical | BT667542 | DNS Express does not correctly process multi-message DNS IXFR updates. | 14.0.0, 13.1.0.2 |
645615-6 | 2-Critical | K70543226, BT645615 | zxfrd may fail and restart after multiple failovers between blades in a chassis. | 13.1.0.2, 13.1.0, 12.1.3.1, 11.6.3, 11.5.7 |
655233-2 | 3-Major | K93338593, BT655233 | DNS Express using wrong TTL for SOA RRSIG record in NoData response | 13.1.0.2, 13.1.0, 12.1.3.1 |
648766-2 | 3-Major | K57853542, BT648766 | DNS Express responses missing SOA record in NoData responses if CNAMEs present | 13.1.0.2, 13.1.0, 12.1.3.1 |
646615-2 | 4-Minor | BT646615 | Improved default storage size for DNS Express database | 13.1.0.2, 13.1.0, 12.1.3.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
699720-1 | 2-Critical | BT699720 | ASM crash when configuring remote logger for WebSocket traffic with response-logging:all | 14.0.0, 13.1.0.2, 12.1.3.2 |
691670-5 | 2-Critical | BT691670 | Rare BD crash in a specific scenario | 14.0.0, 13.1.0.2, 12.1.3.2, 11.6.3.2, 11.5.6 |
686108-1 | 2-Critical | BT686108 | User gets blocking page instead of captcha during brute force attack | 14.0.0, 13.1.0.2 |
684312-1 | 2-Critical | K54140729, BT684312 | During Apply Policy action, bd agent crashes, causing the machine to go Offline | 14.0.0, 13.1.0.2, 12.1.3.2, 11.6.3.2 |
698940-1 | 3-Major | BT698940 | Add new security policy template for API driven systems - "API Security" | 14.0.0, 13.1.0.2 |
690883-1 | 3-Major | BT690883 | BIG-IQ: Changing learning mode for elements does not always take effect | 14.0.0, 13.1.0.2 |
686517-2 | 3-Major | BT686517 | Changes to a parent policy that has no active children are not synced to the secondary chassis slots. | 14.0.0, 13.1.0.2 |
686470-1 | 3-Major | BT686470 | Enable AJAX Response Page or Single Page Application support causes the part of the web page failed to load. | 14.0.0, 13.1.0.2 |
686452-1 | 3-Major | BT686452 | File Content Detection Formats are not exported in Policy XML | 14.0.0, 13.1.0.2 |
685964-1 | 3-Major | BT685964 | cs_qualified_urls bigdb does not cause configured URLs to be qualified. | 14.0.0, 13.1.0.2 |
685771-1 | 3-Major | BT685771 | Policies cannot be created with SAP, OWA, or SharePoint templates | 14.0.0, 13.1.0.2 |
685207-1 | 3-Major | DoS client side challenge does not encode the Referer header. | 14.0.0, 13.1.0.2, 12.1.3.2, 11.6.3.2, 11.5.6 | |
685164-1 | 3-Major | K34646484, BT685164 | In partitions with default route domain != 0 request log is not showing requests | 14.0.0, 13.1.0.2, 12.1.5 |
683508-1 | 3-Major | K00152663, BT683508 | WebSockets: umu memory leak of binary frames when remote logger is configured | 14.0.0, 13.1.0.2, 12.1.3.2 |
680353-1 | 3-Major | BT680353 | Brute force sourced based mitigation is not working as expected | 14.0.0, 13.1.0.2 |
674494-4 | 3-Major | K77993010, BT674494 | BD memory leak on specific configuration and specific traffic | 14.0.0, 13.1.0.2, 13.1.0, 12.1.3.2 |
668184-2 | 3-Major | BT668184 | Huge values are shown in the AVR statistics for ASM violations | 14.0.0, 13.1.0.2, 12.1.3.2 |
694073-3 | 4-Minor | BT694073 | All signature update details are shown in 'View update history from previous BIG-IP versions' popup | 13.1.0.2, 12.1.3.2, 11.6.3 |
685193-1 | 4-Minor | BT685193 | If Inheritance is None in the Parent Policy and there are at least 1 child policy, the number of Comments shown in Inheritance Settings is equal to number of child policies | 14.0.0, 13.1.0.2 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
697421 | 3-Major | BT697421 | Monpd core when trying to restart | 13.1.0.2 |
688813-2 | 3-Major | K23345645, BT688813 | Some ASM tables can massively grow in size. | 14.0.0, 13.1.0.2 |
686510-1 | 3-Major | BT686510 | If tmm was restarted during an attack, the attack might appear ongoing in GUI | 14.0.0, 13.1.0.2 |
683474 | 3-Major | The case-sensitive problem during comparison of 2 Virtual Servers | 14.0.0, 13.1.0.2 | |
679088-1 | 3-Major | BT679088 | Avr reporting and analytics does not display statistics of many source regions | 14.0.0, 13.1.0.2 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
684852-1 | 2-Critical | BT684852 | Obfuscator not producing deterministic output | 14.0.0, 13.1.0.2 |
692123 | 3-Major | BT692123 | GET parameter is grayed out if MobileSafe is not licensed | 13.1.0.2, 12.1.3.2 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
700320 | 2-Critical | BT700320 | tmm core under stress when BADOS configured and attack signatures enabled | 14.0.0, 13.1.0.2 |
691462-1 | 3-Major | BT691462 | Bad actors detection might not work when signature mitigation blocks bad traffic | 14.0.0, 13.1.0.2 |
687987 | 3-Major | BT687987 | Presentation of signatures in human-readable format | 13.1.0.2 |
687986 | 3-Major | BT687986 | High CPU consumption during signature generation, not limited number of signatures per virtual server | 13.1.0.2 |
687984 | 3-Major | BT687984 | Attacks with randomization of HTTP headers parameters generates too many signatures | 13.1.0.2 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
698396-1 | 2-Critical | BT698396 | Config load failed after upgrade from 12.1.2 to 13.x or 14.x★ | 14.0.0, 13.1.0.2 |
Cumulative fixes from BIG-IP v13.1.0.1 that are included in this release
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
686190-1 | 2-Critical | BT686190 | LRO performance impact with BWC and FastL4 virtual server | 14.0.0, 13.1.0.1 |
667173-1 | 2-Critical | BT667173 | 13.1.0 cannot join a device group with 13.1.0.1 | 14.0.0, 13.1.0.1, 12.1.3.1, 11.6.3 |
683114-2 | 3-Major | BT683114 | Need support for 4th element version in Update Check | 14.0.0, 13.1.0.1, 12.1.3.1 |
Performance Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
685628-1 | 1-Blocking | BT685628 | Performance regression on B4450 blade★ | 13.1.0.1 |
673832-1 | 1-Blocking | BT673832 | Performance impact for certain platforms after upgrading to 13.1.0. | 14.0.0, 13.1.0.1 |
696525-1 | 2-Critical | BT696525 | B2250 blades experience degraded performance. | 14.0.0, 13.1.0.1 |
Cumulative fix details for BIG-IP v13.1.5.1 that are included in this release
999125-4 : After changing management IP addresses, devices can be stuck indefinitely in improper Active/Active or Standby/Standby states.
Links to More Info: BT999125
Component: TMOS
Symptoms:
After a device (or multiple devices) in a sync-failover device-group undergoes a management IP change, multiple devices in the group can be stuck indefinitely in improper Active/Active or Standby/Standby failover states.
Conditions:
-- One or more devices belonging to a sync-failover device-group undergo a management IP change.
Impact:
-- The affected units are unable to pass traffic, as they are either both Standby or Active (resulting in either no service availability or IP address conflicts in the network).
Workaround:
If you are planning to change management IP addresses on your devices, consider doing so during a maintenance window, in order to account for the eventuality this issue might occur.
Then, if this issue does occur, you can restore correct system functionality by restarting the sod daemon on all units that had their management IP address changed. To do so, run the following command:
tmsh restart sys service sod
Note: This is a one-time workaround, and the issue may re-occur if the devices undergo further management IP address changes in the future.
Fix:
Redundant devices remain in the correct failover state following a management IP address change.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
997137-5 : CSRF token modification may allow WAF bypass on GET requests
Links to More Info: K80945213, BT997137
Component: Application Security Manager
Symptoms:
Under certain conditions a parameter is not processed as expected.
Conditions:
1. CSRF feature is configured
2. Request contains a crafted parameter
Impact:
Malicious request will bypass signatures and will not raise any attack signature violation
Workaround:
N/A
Fix:
The parameter is now processed as expected.
Fixed Versions:
16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5
996381-5 : ASM attack signature may not match as expected
Links to More Info: K41503304, BT996381
Component: Application Security Manager
Symptoms:
When processing traffic with ASM, attack signature 200000128 may not match as expected.
Conditions:
- Attack signature 200000128 enabled.
Impact:
Processed traffic may not match all expected attack signatures
Workaround:
N/A
Fix:
Attack signature 200000128 now matches as expected.
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1
996113-5 : SIP messages with unbalanced escaped quotes in headers are dropped
Links to More Info: BT996113
Component: Service Provider
Symptoms:
Dropped SIP messages.
Conditions:
-- MRF SIP virtual server
-- SIP Header Field has an escaped quote
Impact:
Certain SIP messages are not being passed via MRF.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
995853-4 : Mixing IPv4 and IPv6 device IPs on GSLB server object results in nullGeneral database error.
Links to More Info: BT995853
Component: Global Traffic Manager (DNS)
Symptoms:
Unable to create GLSB Server object with both IPv4 and IPv6 self IPs as device IPs.
Conditions:
-- DNS and LTM services enabled.
-- Configure two self IPs on the box for IPv4 and IPv6.
-- GLSB Server object creation with IPv4 and IPv6 addresses in device tab along with Virtual Server Discovery enable.
Impact:
GSLB Server object creation fails.
Workaround:
TMSH is not impacted. Use TMSH to create GSLB Server objects.
Fix:
GSLB Server object creation no longer fails.
Fixed Versions:
16.1.0, 15.1.4, 14.1.4.4, 13.1.5
995629-1 : Loading UCS files may hang if ASM is provisioned★
Links to More Info: BT995629
Component: TMOS
Symptoms:
If a UCS file from a BIG-IP system running a different software version that also has an ASM configuration is loaded onto a device that already has ASM provisioned, the load may hang indefinitely.
Conditions:
-- A system that has ASM provisioned.
-- Loading a UCS file with an ASM configuration that comes from a different system.
Impact:
-- UCS load might fail.
-- Config save and load operations fail while the UCS load hangs. The failure of those operations may not be obvious, leaving the BIG-IP saved configuration different from the running configuration.
Workaround:
If you encounter this, run 'load sys config default' to de-provision ASM. The UCS file should then load successfully.
Note: If loading a UCS archive with the 'platform-migrate' argument, then there is no workaround. See: https://cdn.f5.com/product/bugtracker/ID990849.html
Fix:
Loading UCS files no longer hangs if ASM is provisioned.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4.1
994801-5 : SCP file transfer system
Component: TMOS
Symptoms:
Under certain conditions, the SCP file transfer system does not follow current best practices.
Conditions:
tmsh does not follow best practices for SCP operations
Impact:
tmsh does not follow best practices for SCP operations
Workaround:
None
Fix:
The SCP file transfer system now follows current best practices.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.3, 13.1.4.1
993613-3 : Device fails to request full sync
Links to More Info: BT993613
Component: Application Security Manager
Symptoms:
Devices remain out of sync and ASM REST/GUI becomes unresponsive. asm_config_server may create many unique PIDs
Conditions:
-- A manual sync device group is configured and ASM sync is enabled.
-- Sync pushes are typically performed in one direction, and then a sync attempt is made in the opposite direction.
Impact:
-- The device that is meant to receive the config sync never requests or receives it.
-- The devices become unsynchronized which may cause unexpected traffic enforcement or dropped traffic.
-- ASM GUI becomes unresponsive.
-- Large number of asm_config_server processes increases host memory usage
Workaround:
Halting asm_config_server on the stuck device restores the working state and request a new sync.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
993489-6 : GTM daemon leaks memory when reading GTM link objects
Links to More Info: BT993489
Component: Global Traffic Manager (DNS)
Symptoms:
The gtmd process memory consumption is higher than expected.
Conditions:
DNS is provisioned and a provisioned GTM link object has been loaded.
Impact:
Increased memory usage of the GTM daemon. This may impact other capabilities, such as starting sync operations.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
990849-4 : Loading UCS with platform-migrate option hangs and requires exiting from the command★
Links to More Info: BT990849
Component: TMOS
Symptoms:
The UCS loading process with platform-migrate stops responding and hangs after printing:
Platform migrate loaded successfully. Saving configuration.
Conditions:
Load UCS with platform-migrate option:
tmsh load sys ucs <ucs_name> platform-migrate
Note: If you are loading a UCS archive created on a system running a different software version that also has an ASM configuration, there are other other aspects to consider. See: https://cdn.f5.com/product/bugtracker/ID995629.html
Impact:
The UCS loading process stops responding, causing the device to be in an INOPERATIVE state.
Workaround:
None.
Fix:
Loading UCS with the platform-migrate option executes smoothly without getting stuck.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4.1
989701-3 : CVE-2020-25212 Kernel: A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response
987157 : BIG-IP ASM system may not properly perform attack signature checks
Links to More Info: K05391775, BT987157
Component: Application Security Manager
Symptoms:
For more information see: https://support.f5.com/csp/article/K05391775
Conditions:
For more information see: https://support.f5.com/csp/article/K05391775
Impact:
For more information see: https://support.f5.com/csp/article/K05391775
Workaround:
N/A
Fix:
For more information see: https://support.f5.com/csp/article/K05391775
Fixed Versions:
13.1.5
985953-1 : GRE Transparent Ethernet Bridging inner MAC overwrite
Links to More Info: BT985953
Component: TMOS
Symptoms:
Traffic not being collected by virtual server and therefore not being forwarded to the nodes.
Conditions:
Encapsulated dest-mac is not equal to the Generic Routing Encapsulation (GRE) tunnel mac-address.
Impact:
Virtual server is not collecting decapsulated packets from the GRE Transparent Bridge tunnel unless the dest-mac of the encapsulated packet is the same as the mac-address of the GRE tunnel.
Workaround:
None
Fix:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.
Set the DB key to 'enable' to cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic:
tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config
This allows virtual servers on the BIG-IP system to process traffic.
Behavior Change:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.
To cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic, set the DB key to 'enable' and save the config:
tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config
This allows virtual servers on the BIG-IP system to process traffic.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
984593-4 : BD crash
Links to More Info: BT984593
Component: Application Security Manager
Symptoms:
BD crashes.
Conditions:
The conditions under which this occurs are unknown.
Impact:
Traffic disrupted while bd restarts.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
982757-7 : APM Access Guided Configuration hardening
Links to More Info: K53197140
981385-5 : AVRD does not send HTTP events to BIG-IQ DCD
Links to More Info: BT981385
Component: Application Visibility and Reporting
Symptoms:
AVRD does not send HTTP events to BIG-IQ data collection device (DCD).
Conditions:
This happens under normal operation.
Impact:
AVRD does not write Traffic Capture logs for analysis. Cannot analyze issues when Traffic Capture does not provide event information.
Workaround:
None.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4
980325-3 : Chmand core due to memory leak from dossier requests.
Links to More Info: BT980325
Component: TMOS
Symptoms:
Chmand generates a core file when get_dossier is run continuously.
Due to excessive dossier requests, there is a high consumption of memory. The program is terminated with signal SIGSEGV, Segmentation fault.
Conditions:
Repeated/continuous dossier requests during licensing operations.
Impact:
Chmand crashes; potential traffic impact while chmand restarts.
Workaround:
None.
Fixed Versions:
16.1.0, 15.1.4, 14.1.4.4, 13.1.5
976501-4 : Failed to establish VPN connection
Links to More Info: BT976501
Component: Access Policy Manager
Symptoms:
VPN client exits with message "Failed to establish VPN connection"
Conditions:
-- Connect to Network Access using web browser.
-- Disconnect and then click on the Network Access resource again in the Webtop
-- Internet Explorer browser
Impact:
Client will be unable to launch the VPN tunnel from the browser.
Workaround:
Clear cache in the browser and retry.
Disable caching in the browser.
Fixed Versions:
16.1.0, 15.1.3, 14.1.4, 13.1.3.6
974093-2 : Linux kernel vulnerability CVE-2020-25705
Links to More Info: K09604370
973261-5 : GTM HTTPS monitor w/ SSL cert fails to open connections to monitored objects
Links to More Info: BT973261
Component: Global Traffic Manager (DNS)
Symptoms:
Big3d does not try to open TCP connections if a HTTPS monitor contains a cert/key.
/var/log/gtm shows:
err big3d[19217]: 01333001:3: Start: SSL error:02001002:system library:fopen:No such file or directory
err big3d[19217]: 01333001:3: Start: SSL error:20074002:BIO routines:FILE_CTRL:system lib
err big3d[19217]: 01333001:3: Start: SSL error:140CE002:SSL routines:SSL_use_RSAPrivateKey_file:system lib
err big3d[19217]: 01330014:3: CSSLSocket:: Unable to get the session.
Conditions:
GTM HTTPS monitor with non-default cert/key.
Impact:
Unable to use HTTPs monitor.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
970329-5 : ASM hardening
Links to More Info: K70134152, BT970329
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM does not follow current best practices.
Conditions:
- ASM provisioned
Impact:
Attack detection is not triggered as expected
Workaround:
N/A
Fix:
Attack detection is now triggered as expected
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
969105-5 : HA failover connections via the management address do not work on vCMP guests running on VIPRION
Links to More Info: BT969105
Component: TMOS
Symptoms:
A high availability (HA) failover connection using the management IP addresses does not work on vCMP guests running on a VIPRION device.
BIG-IP instances running directly on hardware, on Virtual Edition, and as vCMP guests running on an appliance are unaffected.
HA failover connections using self IPs are unaffected.
Conditions:
-- vCMP guest running on a VIPRION device
-- high availability (HA) failover connection using the management IP addresses (unicast and/or multicast)
Impact:
Failover state determination over the management port is permanently down.
Workaround:
While self IP-based high availability (HA) failover connections are not affected by this issue, F5 recommends configuring failover connections over both management IPs and self IPs (as detailed in K37361453: Configuring network failover for redundant VIPRION systems :: https://support.f5.com/csp/article/K37361453).
To mitigate this issue, run the following command on each blade of every guest:
touch /var/run/chmand.pid
The workaround does not survive a reboot, so a more permanent workaround is to edit the file /config/startup and add a line to touch /var/run/chmand.pid.
Add this line to the end of /config/startup:
(sleep 120; touch /var/run/chmand.pid) &
Note: The sleep time of 120 seconds should be tested as it depends on how quickly or slowly the Guest starts up, so the appropriate value for one system may differ from another system.
Alternatively, You can use instructions in K11948: Configuring the BIG-IP system to run commands or scripts upon system startup :: https://support.f5.com/csp/article/K11948 to issue commands at system startup after verification if mcpd is up and ready, e.g.:
#!/bin/bash
source /usr/lib/bigstart/bigip-ready-functions
wait_bigip_ready
# Customized startup command(s) can be added below this line.
touch /var/run/chmand.pid
# Customized startup command(s) should end above this line.
You may also request an Engineering Hotfix from F5.
Fixed Versions:
16.1.0, 15.1.4, 14.1.4.4, 13.1.5
968733-4 : CVE-2018-1120 kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
968421-5 : ASM attack signature doesn't matched
Links to More Info: K30291321, BT968421
Component: Application Security Manager
Symptoms:
A specific attack signature doesn't match as expected.
Conditions:
Undisclosed conditions.
Impact:
Attack signature does not match as expected, request is not logged.
Workaround:
N/A
Fix:
Attack signature now matches as expected.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.2.1, 14.1.4.2, 13.1.4.1, 12.1.6, 11.6.5.3
967905-1 : Attaching a static bandwidth controller to a virtual server chain can cause tmm to crash
Links to More Info: BT967905
Component: TMOS
Symptoms:
Tmm crashes.
Conditions:
-- static bwc
-- virtual to virtual chain
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Do not use the static bwc on a virtual chain.
Fix:
Fixed a tmm crash.
Fixed Versions:
17.0.0, 16.0.1.2, 15.1.4, 14.1.4.3, 13.1.4.1
967745-4 : Last resort pool error for the modify command for Wide IP
Links to More Info: BT967745
Component: TMOS
Symptoms:
System reports error for the modify command for Wide IP.
01b60021:3: Last resort pool type not specified for Wide IP 9084.example.com of type A.
Conditions:
Running the modify command involving last-resort-pool and not specifying a type or name for the object.
Impact:
The object is not modified, and the system reports an error.
Workaround:
The GSLB type needs to be given for any and all TMSH commands that utilize GTM Wide IPs or GTM Pools.
Append the command with last-resort-pool a <pool_name>, for example:
modify a 9084.example.com aliases replace-all-with { 9084.example1.com } last-resort-pool a pool1_test
Fix:
The GSLB type needs to be given for any and all TMSH commands that utilize GTM Wide IPs or GTM Pools.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.4
965485-1 : CVE-2019-5482 Heap buffer overflow in the TFTP protocol handler in cURL
Links to More Info: K41523201
965229-4 : ASM Load hangs after upgrade★
Links to More Info: BT965229
Component: Application Security Manager
Symptoms:
ASM upgrade hangs, and you see the following in
var/log/ts/asm_start.log:
-------------------------
asm_start|DEBUG|Nov 15 07:04:41.751|25365|F5::ConfigSync::restore_active_policies,,Restoring active policy - policy /Common/my_portal (id = 603)
... END OF FILE ...
-------------------------
In /var/log/asm:
-----------------------------
2020-11-15T06:01:23+00:00 localhost notice boot_marker : ---===[ HD1.cm6250 - BIG-IP 13.1.3.4 Build 0.255.5 <HD1.cm6250> ]===---
info set_ibdata1_size.pl[20499]: Setting ibdata1 size finished successfully, a new size is: 9216M
info tsconfig.pl[24675]: ASM initial configration script launched
info tsconfig.pl[24675]: ASM initial configration script finished
info asm_start[25365]: ASM config loaded
err asm_tables_dump.pl[31430]: gave up waiting for ASM to start, please try again later
-----------------------------
Conditions:
-- ASM provisioned
-- 600 or more security policies
-- Performing an upgrade
Impact:
ASM post upgrade config load hangs and there are no logs or errors
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
964245-4 : ASM reports and enforces username always
Links to More Info: BT964245
Component: Application Security Manager
Symptoms:
When session tracking is enabled and configured to enforce usernames for a specific list of login URLs, the username which arrives in an Authorization header is being enforced even if the request to the URL with the Authorization is not configured at all as a login URL.
Conditions:
Session tracking is enabled for login URLs with the Username Threshold set to 1.
Impact:
Username from the Authorization appears with status = BLOCK-ALL in the session tracking status list, even though session tracking is not configured for that URL.
Workaround:
None
Fix:
Username from the Authorization not appearing with status = BLOCK-ALL in session tracking status list.
Fixed Versions:
16.1.0, 15.1.4, 14.1.4.4, 13.1.5
963705-1 : Proxy ssl server response not forwarded
Links to More Info: BT963705
Component: Local Traffic Manager
Symptoms:
A server response may not be forwarded after TLS renegotiation.
Conditions:
-- Proxy ssl enabled
-- A server renegotiation occurs
Impact:
Server response may not be not forwarded
Fix:
Proxy ssl will now forward server response after renegotiation
Fixed Versions:
16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5
962497-5 : BD crash after ICAP response
Links to More Info: BT962497
Component: Application Security Manager
Symptoms:
BD crash when checking ICAP job after ICAP response
Conditions:
BD is used with ICAP feature
Impact:
Traffic disrupted while BD restarts.
Workaround:
N/A
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
962433-2 : HTTP::retry for a HEAD request fails to create new connection
Links to More Info: BT962433
Component: Local Traffic Manager
Symptoms:
In case of a HEAD request, BIG-IP fails to set up a new connection to the server with the HTTP::retry iRule.
Conditions:
1.) Basic HTTP profile is configured on BIG-IP
2.) BIG-IP sends the HEAD request to the server and gets error response
3.) iRule with HTTP::retry is configured
4.) The system is using the default (non-debug) TMM version
Impact:
BIG-IP might send the retry HEAD request after the connection is closed, more specifically after the server has sent a FIN, the retry is leaked on the network.
Fixed Versions:
15.1.4, 14.1.4.3, 13.1.4.1
962177-4 : Results of POLICY::names and POLICY::rules commands may be incorrect
Links to More Info: BT962177
Component: Local Traffic Manager
Symptoms:
When a traffic policy is applied to a virtual server, the iRule commands POLICY::names and POLICY::rules returns incorrect results.
Conditions:
-- BIG-IP has a virtual server with one or more traffic policies having more than one rule.
-- An iRule with POLICY::names and/or POLICY::rules is applied to virtual server to run on multiple transactions over the same connection.
Impact:
Traffic processing may not provide expected results.
Fix:
POLICY::names and POLICY::rules provide atomic results per transaction going over a same connection.
Fixed Versions:
17.0.0, 16.0.1.2, 15.1.4, 14.1.4, 13.1.4.1
960749-4 : TMM may crash when handling 'DNS Cache' or 'Network DNS Resolver' traffic
Links to More Info: BT960749
Component: Global Traffic Manager (DNS)
Symptoms:
TMM crashes, dumps a core file, and restarts.
Conditions:
-- The configuration includes one or more 'DNS Cache' or 'Network DNS Resolver' objects.
-- The DNS Cache or Network DNS Resolver objects receive traffic.
Impact:
Traffic disrupted while tmm restarts. A redundant unit will fail over.
Fix:
TMM no longer crashes when 'DNS Cache' or 'Network DNS Resolver' objects handle traffic.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5, 12.1.6, 11.6.5.3
960437-4 : The BIG-IP system may initially fail to resolve some DNS queries
Links to More Info: BT960437
Component: Global Traffic Manager (DNS)
Symptoms:
Configurations that use a 'DNS Cache' or 'Network DNS Resolver' are affected by an issue whereby the system may initially fail to resolve some DNS queries.
Subsequent queries for the same domain name, however, work as expected.
Only some domain names are affected.
Conditions:
- The BIG-IP system is configured with either a DNS Cache or Network DNS Resolver.
- The cache is still empty in regard to the domain name being resolved (for example, TMM has just started).
- The cache configuration specifies 'Use IPv6' (the default) but the system has no IPv6 default route.
Impact:
Initial DNS resolution of some domain names fails. Regardless of whether this happens via a DNS cache or Network DNS Resolver, the failure is returned to the client.
In the case of a DNS Cache, the client may just be returned with no record. In the case of a Network DNS Resolver, the failure will depend on the feature using the resolver.
For instance, SWG, SSL Orchestrator, or the HTTP Explicit Forward Proxy, in general, are examples of features that rely on a Network DNS Resolver. In this case, the client's browser will fail to connect to the requested destination, and the client will be shown a proxy error.
Workaround:
Disable 'Use IPv6' in the affected DNS Cache or Network DNS Resolver.
1a. Go to DNS :: Caches :: Cache list.
OR
1b. Go to Network :: DNS Resolvers :: DNS Resolver list.
2. Select the item you want to update in the list.
3. Uncheck 'Use IPv6'
4, Select Update.
You can keep the object in this state (with no consequences) until you define an IPv6 default route on the system, and you wish for the system to also use IPv6 to connect to Internet name-servers.
Fix:
DNS resolution works as expected, with domains resolving the first time they are queried.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5, 12.1.6, 11.6.5.3
958093-1 : IPv6 routes missing after BGP graceful restart
Links to More Info: BT958093
Component: TMOS
Symptoms:
When BGP graceful restart is configured for peers in IPv4 unicast and IPv6 unicast address families, after graceful restart for both IPv4 and Ipv6 address families, routes from IPv6 unicast address family might be missing.
Conditions:
- Different BGP peers configured in IPv4 unicast and IPv6 unicast address families.
- BGP graceful restart happens for both IPv4 unicast and IPv6 unicast.
Impact:
Routes from IPv6 peers are missing. They are also not present in the RIB.
Fixed Versions:
16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5
957905-4 : SIP Requests / Responses over TCP without content_length header are not aborted by BIG-IP.
Links to More Info: BT957905
Component: Service Provider
Symptoms:
SIP Requests that don't contain a content_length header are accepted and forwarded by the BIG-IP to the server.
SIP Responses that don't contain a content_length header are accepted and forwarded to the client.
The sipmsg parser does not treats the content_length header as a required header as part of the SIP Request / Response.
Conditions:
SIP request / response without content_length header.
Impact:
RFC 6731 non compliance.
Workaround:
N/A
Fix:
BIG-IP now aborts the connection of any TCP SIP request / response that does not contain a content_length header.
content_length header is treated as optional for UDP and SCTP.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
957897-3 : Unable to modify gateway-ICMP monitor fields in the GUI
Links to More Info: BT957897
Component: TMOS
Symptoms:
While modifying a gateway-ICMP monitor you see the following error:
01070374:3: Cannot modify the address type of monitor /Common/<monitor_name>.
Conditions:
-- Using the GUI to modify a Gateway-ICMP monitor field.
-- The monitor is attached with a pool that has one or more pool members.
Impact:
You cannot update the Gateway-ICMP monitor fields via the GUI.
Workaround:
Use the tmsh command:
tmsh modify ltm monitor gateway-icmp <monitor_name> [<field> <new_value>]
For example, to update the description of a monitor named gw_icmp, use the following command:
modify ltm monitor gateway-icmp gw_icmp description new_description
Fix:
You can now update the Gateway-ICMP monitor fields via the GUI.
Fixed Versions:
16.1.0, 15.1.5.1, 14.1.4.6, 13.1.5
956937 : Duplicate Attack signature sets in policy containing server technologies
Links to More Info: BT956937
Component: Application Security Manager
Symptoms:
When creating a new security policy, choosing a server technology for the policy causes duplicate signature sets to be created.
Conditions:
-- Create a new security policy using a server technology
-- Create another security policy using the same server technology
Impact:
Duplicate signature sets are created.
Workaround:
You can repair the policy by navigating to “Security ›› Application Security : Policy Building : Learning and Blocking Settings”, clicking on “change”, and choosing the original created sets instead of the duplicated sets. Save, and then apply the policy. The duplicated sets can be deleted after that.
Fixed Versions:
13.1.5
956589-4 : The tmrouted daemon restarts and produces a core file
Links to More Info: BT956589
Component: TMOS
Symptoms:
The tmrouted daemon restarts and produces a core file.
Conditions:
Exact trigger is unknown, but the issue was seen on a chassis setup during a blade failover
Impact:
Traffic disrupted while tmrouted restarts.
Workaround:
None
Fix:
Tmrouted daemon should not restart during blade reset
Fixed Versions:
16.1.0, 15.1.2.1, 14.1.4.6, 13.1.5
955617-5 : Cannot modify properties of a monitor that is already in use by a pool
Links to More Info: BT955617
Component: Local Traffic Manager
Symptoms:
Modifying monitor properties gives error, if it is attached to a pool with Node/Pool member instance.
0107082c:3: Cannot modify the destination address of monitor /Common/my_monitor
Conditions:
-- Monitor with alias address field as default properties.
-- Pool containing a node or pool member.
-- Monitor is attached to the pool.
Impact:
Monitor properties can't be modified if they are in use by a pool.
Workaround:
Remove monitor, modify it, and then add it back.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
955017-5 : Excessive CPU consumption by asm_config_event_handler
Links to More Info: BT955017
Component: Application Security Manager
Symptoms:
Asm_config_event_handler is consuming a lot of CPU while processing signatures after sync
Conditions:
This is encountered during a UCS load, or by a high availability (HA) configuration sync.
Impact:
Asm_config_server_rpc_handler.pl consumes excessive CPU and takes an exceedingly long time to complete.
Workaround:
Disable the signature staging action item for all policies.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1
953845-5 : After re-initializing the onboard FIPS HSM, BIG-IP may lose access after second MCPD restart
Links to More Info: BT953845
Component: Local Traffic Manager
Symptoms:
When re-initializing an onboard HSM on particular platforms, BIG-IP may disconnect from the HSM after a second restart of the MCPD daemon.
This can occur when using administrative commands such as:
-- tmsh run util fips-util init
-- fipsutil init
-- tmsh run util fips-util loginreset -r
-- fipsutil loginreset -r
Conditions:
-- Using the following platforms:
+ i5820-DF / i7820-DF
+ 5250v-F / 7200v-F
+ 10200v-F
+ 10350v-F
+ vCMP guest on i5820-DF / i7820-DF
+ vCMP guest on 10350v-F
Impact:
BIG-IP is unable to communicate with the onboard HSM.
Workaround:
The last step in using "fipsutil init" is to restart all system services ("tmsh restart sys service all") or reboot.
Immediately before doing this:
-- open /config/bigip.conf in a text editor (e.g. vim or nano)
-- locate and delete the configuration "sys fipsuser f5cu" stanza, e.g.:
sys fipsuser f5cu {
password $M$Et$b3R0ZXJzCg==
}
Fix:
Fixed an issue with re-initializing the onboard FIPS HSM.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4, 12.1.6
953729-4 : Advanced WAF/ASM TMUI authenticated remote command execution vulnerabilities CVE-2021-22989 and CVE-2021-22990
953677-4 : TMUI authenticated remote command execution vulnerabilities CVE-2021-22987 and CVE-2021-22988
951033-1 : Virtual server resets all the connections for rstcause 'VIP disabled (administrative)'
Links to More Info: BT951033
Component: Local Traffic Manager
Symptoms:
Virtual server resets all the connections for rstcause 'VIP disabled (administrative)', after all the conditions are met.
Once it happens, the virtual server starts resetting all the incoming connections for rstcause 'VIP disabled (administrative)'. This continues even after the connection limit is deactivated.
Conditions:
-- There is at least one pool member that is DISABLED.
-- Other pool members have a connection limit configured.
-- A configuration change occurs while the connection limit is activated, and the change lowers the connection limit value, for example, the value is changed from 10 to 5.
Impact:
A virtual server continues resetting new connections.
Workaround:
Use Forced offline instead of disabled to prevent this issue.
Fix:
The BIG-IP system no longer continually resets new connections when the connection limit is lowered while it is being enforced.
Fixed Versions:
15.1.0, 14.1.3.1, 13.1.3.5
950917-3 : Apply Policy fails due to internal signature overlap following ASU ASM-SignatureFile_20200917_175034
Links to More Info: BT950917
Component: Application Security Manager
Symptoms:
Following Signature Update (-SignatureFile_20200921_124008 or later), newly added/activated policies may fail Apply Policy due to a duplicate key database error:
01310027:2: subsystem error (asm_config_server.pl,F5::SetActive::Impl::set_active): Setting policy active failed: Failed to insert to DCC.ACCOUNT_NEGSIG_SIGNATURE_PROPERTIES (DBD::mysql::db do failed: Duplicate entry '8112518117000363265' for key 'PRIMARY' at /usr/local/share/perl5/F5/BatchInsert.pm line 219. )
Conditions:
Signature Update -SignatureFile_20200921_124008 is installed, and a newly imported or inactive policy is applied.
Impact:
Apply policy fails.
Workaround:
You can use any of the following workarounds:
-- Install an older signature update -SignatureFile_20200917_175034
-- Disable staging for either signature 200101255 or signature 200101258 (or both) in the affected policies. The policy can then be successfully applied.
-- Run the following SQL command to correct all affected policies on the device:
----------------------------------------------------------------------
UPDATE PL_POLICY_NEGSIG_SIGNATURES policy_sigs INNER JOIN (select previous_enforced_rule_md5, policy_id, count(*) as mycount from PL_POLICY_NEGSIG_SIGNATURES where previous_enforced_rule_md5 != '' group by previous_enforced_rule_md5, policy_id having mycount > 1) as multi_sigs on policy_sigs.policy_id = multi_sigs.policy_id and policy_sigs.previous_enforced_rule_md5 = multi_sigs.previous_enforced_rule_md5 SET policy_sigs.previous_enforced_rule_md5 = '', policy_sigs.previous_enforced_rule = '';
----------------------------------------------------------------------
Fixed Versions:
17.0.0, 15.1.4, 14.1.4.2, 13.1.4.1
950077-4 : TMUI authenticated remote command execution vulnerabilities CVE-2021-22987 and CVE-2021-22988
949889-1 : CVE-2019-3900: An infinite loop issue was found in the vhost_net kernel module while handling incoming packets in handle_rx()
949593-1 : Unable to load config if AVR widgets were created under '[All]' partition★
Links to More Info: BT949593
Component: Application Visibility and Reporting
Symptoms:
When upgrading to or loading saved configuration on BIG-IP software v13.0.0 or later, if the configuration contains AVR widgets created under a partition of '[All]', the config load fails.
Conditions:
This occurs if one or more AVR widgets in the configuration was created under the read-only '[All]' pseudo-partition.
This could have occurred if you were running a version of BIG-IP which did not include the fix for ID 721408.
Impact:
Upgrading to or loading an affected configuration on BIG-IP v13.x or later fails.
Workaround:
Manually edit the /config/bigip.conf configuration file and change '[All]' to 'Common':
# sed -i 's/\\\[All\]/Common/g' /config/bigip.conf
# tmsh load sys config
# tmsh save sys config
This should be done before upgrading to BIG-IP v13.x or later, or before saving configuration to be loaded later, or before loading a saved configuration from the config files.
Fix:
It is possible to successfully upgrade from or load a configuration containing one or more AVR widgets created under the read-only '\[All]' pseudo-partition or under other not existing partitions. With the current fix all partitions are changed to "Common" during upgrade.
Fixed Versions:
17.0.0, 16.0.1.2, 15.1.3, 14.1.4, 13.1.4
949145-3 : Improve TCP's response to partial ACKs during loss recovery
Links to More Info: BT949145
Component: Local Traffic Manager
Symptoms:
- A bursty retransmission occurs during TCP's loss recovery period.
Conditions:
- TCP filter is used.
- TCP stack is used instead of TCP4 stack (based on profile settings).
- Packet loss occurs during the data transfer and TCP's loss recovery takes place.
Impact:
The bursty retransmissions may lead to more data getting lost due to large amount of data being injected into the network.
Workaround:
In versions prior to v16.0.0, use a TCP profile which selects the TCP4 stack instead of the TCP stack. There is no workaround for version 16.0.0.
Fix:
Partial ACK handling during loss recovery is improved.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3
948573-3 : Wr_urldbd list of valid TLDs needs to be updated
Links to More Info: BT948573
Component: Traffic Classification Engine
Symptoms:
Several new TLDs have been added and need to be classified. The classification results return "Unknown" when the new TLD is being queried.
Conditions:
New TLD is being queried
Impact:
The URL query with new TLDs can not be blocked with custom feed list.
Custom, Webroot, and Cloud returns Unknown category.
Workaround:
Configure CPM policy to classify traffic based on hostname or SNI rather than urlcat.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
948113-5 : User-defined report scheduling fails
Links to More Info: BT948113
Component: Application Visibility and Reporting
Symptoms:
A scheduled report fails to be sent.
An error message with the following format may appear on /var/log/avr/monpd.log file (some parts of the error message were replaced with '.....' in here to leave only the common parts):
DB|ERROR|....... Error (err-code 1054) executing SQL string :
.....
.....
.....
Because : Unknown column ....... in 'order clause'
Conditions:
1. Using predefined-report in scheduled-report.
2. Predefined-report has more than one measure.
3. Sort-by value is different from the first measure on predefined-report
Impact:
Internal error for AVR report for ASM pre-defined.
Workaround:
First, remount /usr to read-write:
mount -o remount,rw /usr
Next, open file /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm and change the following line:
push(@measures,@{$base_request->{measures}}[0]);
to this:
push(@measures,@{$base_request->{sort_by}}[0]->{measure});
The above can be achieved with the following script-line (please first backup the Client.pm file and then verify it changed it correctly):
sed -i 's/push(@measures,@{\$base_request->{measures}}\[0\])/push(@measures,@{$base_request->{sort_by}}[0]->{measure})/' /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm
Lastly, remount /usr back to read-only:
mount -o remount,ro /usr
Fix:
Using 'sort-by' measure when building PDF (instead of the first value on measure-list)
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
947529-3 : Security tab in virtual server menu renders slowly
Links to More Info: BT947529
Component: TMOS
Symptoms:
When a large number of virtual servers use the same ASM policy from a manually-created LTM Traffic policy, the Security tab of the virtual server takes a long time to load.
Conditions:
Large number of virtual servers using the same ASM policy
Impact:
Loading of Security tab of a virtual server takes a long time
Workaround:
NA
Fix:
Security tab of a virtual server loads fast
Fixed Versions:
16.1.0, 15.1.4.1, 14.1.4.4, 13.1.5
946081-4 : Getcrc tool help displays directory structure instead of version
Links to More Info: BT946081
Component: Application Security Manager
Symptoms:
When getcrc tool displays help to the end user, it displays a directory structure instead of version.
Conditions:
Displaying help in getcrc utility.
Impact:
Version information is not displayed.
Fix:
Getcrc utility help now displays version information.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
944441-4 : BD_XML logs memory usage at TS_DEBUG level
Links to More Info: BT944441
Component: Application Security Manager
Symptoms:
There are two messages in BD_XML logs that the system reports at the TS_DEBUG log level, but they should be logged as TS_INFO.
BD_XML|DEBUG |Sep 10 14:51:19.335|1456|xml_validation.cpp:1687|after create of profile 754. (xml memory 5111702493 bytes)
BD_XML|DEBUG |Sep 10 14:51:19.335|1456|xml_validation.cpp:1586|add profile 755. name: /ws/replanifierIntervention_V1-0 is soap? 1 (xml memory before add 5111702493 bytes)
Conditions:
These messages can occur when XML/JSON profiles are configured.
Impact:
Messages that should be logged at the TS_INFO level are logged at the TS_DEBUG level. These are informational log messages.
Workaround:
None
Fix:
The relevant two BD_XML logs are now categorized as TS_INFO.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
944121-2 : Missing SNI information when using non-default domain https monitor running in TMM mode.
Links to More Info: BT944121
Component: In-tmm monitors
Symptoms:
In-TMM https monitors do not send the SNI (Server Name Indication) information for non-default route domain pool members.
In-TMM monitors do not send any packet when TLS1.3 monitor is used.
Conditions:
-- SNI is configured in serverssl profile
-- serverssl profile is assigned to in-tmm https monitors
-- https monitors are monitoring pool members that are in a non-default route domain.
- Another Condition :
TLS1.3 Monitor is used
Impact:
The TLS connection might fail in case of SNI
No SYN packet is sent in case of TLS1.3 monitor
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
943913-5 : ASM attack signature does not match
Links to More Info: K30150004, BT943913
Component: Application Security Manager
Symptoms:
When processing certain traffic, ASM attack signatures may not match as intended.
Conditions:
- ASM enabled
- Undisclosed attack signature variation
Impact:
ASM attack signature does not match or trigger further processing.
Workaround:
N/A
Fix:
ASM now processes traffic as expected.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3.1, 14.1.4.2, 13.1.4.1
943889 : Reopening the publisher after a failed publishing attempt
Links to More Info: BT943889
Component: Fraud Protection Services
Symptoms:
TMM crashes repeatedly on SIGSEGV.
Conditions:
This can occur after a HSL disconnect and re-connect.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The system publishes data to HSL publisher on a second attempt successfully (after a reconnect).
Fixed Versions:
14.1.4, 13.1.3.5
941853-3 : Logging Profiles do not disassociate from virtual server when multiple changes are made
Links to More Info: BT941853
Component: Application Security Manager
Symptoms:
When multiple Logging Profiles profile changes are made in a single update, the previous Logging Profiles are not disassociated from the virtual server. Additionally, when an Application Security Logging Profile change is made, newly added Protocol Security Logging Profile settings do not take effect.
Conditions:
Multiple Logging Profile changes are made in a single update.
Impact:
The previous Logging Profiles are not disassociated from the virtual server.
Workaround:
Perform each Log Profile change individually. For example, to change an Application Security Log Profile:
1. Remove the current association and save.
2. Add the new association and save again.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3
941621-4 : Brute Force breaks server's Post-Redirect-Get flow
Links to More Info: K91414704, BT941621
Component: Application Security Manager
Symptoms:
Brute Force breaks server's Post-Redirect-Get flow
Conditions:
ASM policy is attached to VS
Brute force protection is enabled.
CSI challenge or Captcha are in use.
Server implements Post-Redirect-Get flow.
Impact:
Brute Force breaks server's Post-Redirect-Get flow
Workaround:
None
Fix:
Support PRG mechanism in brute force mitigations.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.4
941257-3 : Occasional Nitrox3 ZIP engine hang
Links to More Info: BT941257
Component: Local Traffic Manager
Symptoms:
Occasionally the Nitrox3 ZIP engine hangs.
In /var/log/ltm:
crit tmm[12404]: 01010025:2: Device error: n3-compress0 Nitrox 3, Hang Detected: compression device was reset (pci 02:00.1, discarded 1).
crit tmm[12404]: 01010025:2: Device error: n3-compress0 Zip engine ctx eviction (comp_code=0): ctx dropped.
Conditions:
BIG-IP appliance that uses the Nitrox 3 hardware compression chip: 5xxx, 7xxx, 12250 and B2250.
You can check if your platform has the nitrox3 by running the following command:
tmctl -w 200 compress -s provider
provider
--------
bzip2
lzo
nitrox3 <--------
zlib
Impact:
The Nitrox3 hardware compression system becomes unavailable and the compression mode switches to software compression. This can lead to high CPU usage.
Workaround:
Disable http compression
Fixed Versions:
16.1.0, 15.1.4, 14.1.4.4, 13.1.5
941249-1 : Improvement to getcrc tool to print cookie names when cookie attributes are involved
Links to More Info: BT941249
Component: Application Security Manager
Symptoms:
The name provided by getcrc tool provides incorrect ASM cookie name when cookie attributes path or/and domain is/are present in response from server
Conditions:
This is applicable when domain and path cookie attributes are present in response from server
Impact:
ASM cookie name which is displayed is incorrect
Workaround:
None
Fix:
More options need to be added to getcrc tool such that it caters for path/domain cookie attribute/s
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
941089-4 : TMM core when using Multipath TCP
Links to More Info: BT941089
Component: Local Traffic Manager
Symptoms:
In some cases, TMM might crash when processing MPTCP traffic.
Conditions:
A TCP profile with 'Multipath TCP' enabled is attached to a virtual server.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
There is no workaround other than to disable MPTCP.
Fix:
TMM no longer produces a core.
Fixed Versions:
15.1.2, 14.1.3.1, 13.1.3.5, 12.1.5.3
940897-4 : Violations are detected for incorrect parameter in case of "Maximum Array/Object Elements" is reached
Links to More Info: BT940897
Component: Application Security Manager
Symptoms:
False positive violations are detected for incorrect parameter in case of "Maximum Array/Object Elements" is reached with enabled "Parse Parameter".
Conditions:
"JSON data does not comply with format settings" and "Illegal meta character in value" violations are enabled and content profile parsing is enabled in ASM.
Impact:
False positives detected, such as "Illegal meta character in value" violation and attack signature for incorrect context.
Workaround:
N/A
Fix:
No false positives detected.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.6
940401-4 : Mobile Security 'Rooting/Jailbreak Detection' now reads 'Rooting Detection'
Links to More Info: BT940401
Component: Fraud Protection Services
Symptoms:
MobileSafe SDK does not support iOS jailbreak detection, so the GUI should refer only to Android Rooting Detection.
Conditions:
-- Fraud Protection Service (FPS) provisioned.
-- FPS and MobileSafe Licensed.
Impact:
Introduces confusion when indicating that iOS jailbreak detection is supported, which it is not.
Workaround:
None.
Fix:
Section now reads 'Rooting Detection'.
Fixed Versions:
16.1.0, 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5, 12.1.5.3
940249-4 : Sensitive data is not masked after "Maximum Array/Object Elements" is reached
Links to More Info: BT940249
Component: Application Security Manager
Symptoms:
If "Maximum Array/Object Elements" is reached and "JSON data does not comply with format settings" is detected, then all sensitive
data after last allowed element is not masked.
Conditions:
Define JSON profile, set "JSON data does not comply with format settings" to blocking and set "Maximum Array/Object Elements" to desired value.
Impact:
Data after last allowed element is not masked.
Fix:
Now the values are masked.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.6, 11.6.5.3
940021-1 : Syslog-ng hang may lead to unexpected reboot
Links to More Info: BT940021
Component: TMOS
Symptoms:
A syslog-ng issue with remote logging to an invalid remote syslog server may lead to unexpected reboot.
The BIG-IP may unexpectedly reboot after a host watchdog timeout when syslog-ng gets hung up.
Logs via syslog-ng are no longer written, though logging not via syslog-ng continues unaffected.
This happens at the time of the last 'Syslog connection broken' in /var/log/messages before reboot.
That message will appear without a preceding 'Syslog connection established' just before it with same timestamp.
At this time syslog-ng typically spins, using near 100% CPU (just one core equivalent, not all CPU capacity on system).
Typically things appear fine on rest of system - there will usually be adequate CPU and memory.
Hours or days later graphs will have a gap of usually tens of minutes to hours before an unexpected reboot.
Post reboot logs (in /var/log/sel for iSeries or ltm log otherwise) show this is a host watchdog reboot.
After reboot the system runs correctly, though if the syslog-ng remote server was invalid this remains the case.
Conditions:
Invalid syslog-ng server configuration or broken connection from BIG-IP toward configured syslog-ng remote server.
A server is configured as a remote syslog destination on the BIG-IP, but it or an intervening system responds to stream of log messages by breaking connection eg by sending ICMP port unreachable to BIG-IP.
Syslog-ng will note the connection attempt and that it has broken usually in the same second, and do so every 60s when it retries.
There may be many of these log pairs, repeating every minute in /var/log/messages, such as:
Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection established; fd='14', server='AF_INET(192.168.1.1:514)', local='AF_INET(0.0.0.0:0)'
Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'
The final log will of a broken connection only, usually one minute after the last established/broken pair.
Nov 25 03:15:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'
Impact:
Very rarely syslog-ng hangs in a non-functional state. Sometimes, this may lead to an unexpected reboot of BIG-IP. Loss of logs before restart and traffic disrupted while BIG-IP restarts.
Workaround:
Ensure syslog-ng server configuration is valid, and that the server is reachable.
Fix:
Fixed an issue with syslog-ng hang occasionally causing a system restart.
This fix is not a complete fix. You will still need to remove unused syslog-ng servers from the BIG-IP configuration.
ID 1040277 ( https://cdn.f5.com/product/bugtracker/ID1040277.html ) tracks the remaining issue.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6
939529-4 : Branch parameter not parsed properly when topmost via header received with comma separated values
Links to More Info: BT939529
Component: Service Provider
Symptoms:
MRF SIP in LoadBalancing Operation Mode inserts a VIA header to SIP request messages. This Via header is removed from the returned response message. The VIA header contains encrypted routing information to route the response message. The SIP specification states that INVITE/CANCEL messages in a dialogue should contain the same branch header. The code used to encrypt the branch field returns a different branch ID for INVITE and CANCEL messages.
Conditions:
-- Enabling SIP Via header insertion on the BIG-IP system.
-- SIP MRF profile.
-- Need to cancel an INVITE.
-- INVITE Via header received with multiple comma-separated values.
Impact:
Some SIP clients have code to verify the branch fields in the Via header. These clients expect the branch to be same for INVITE and CANCEL in a dialogue. Because the branch received is different, these clients are unable to identify the specific INVITE transaction. CANCEL is received and client sends a 481 error:
SIP/2.0 481 Call/Transaction Does Not Exist.
Workaround:
Use iRules to remove the topmost Via header and add new a new Via header that uses the same branch as INVITE and CANCEL while sending messages to SIP clients.
Fix:
The BIG-IP system now ensures the branch field inserted in the via header same for INVITE and CANCEL messages.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, 11.6.5.3
938233-4 : An unspecified traffic pattern can lead to high memory accumulation and high CPU utilization
Links to More Info: K93231374
936557-4 : Retransmissions of the initial SYN segment on the BIG-IP system's server-side incorrectly use a non-zero acknowledgement number when Verified Accept is enabled.
Links to More Info: BT936557
Component: Local Traffic Manager
Symptoms:
As the BIG-IP system attempts to open a TCP connection to a server-side object (e.g., a pool member), retransmissions of the initial SYN segment incorrectly use a non-zero acknowledgement number.
Conditions:
This issue occurs when the following conditions are true:
-- Standard TCP virtual server.
-- TCP profile with Verified Accept enabled.
-- Receipt of the client's ACK (as part of the client-side TCP 3-way handshake) is delayed. Due to Verified Accept being enabled, this delay causes the BIG-IP system to retransmit its SYN to the server until the client's ACK is received.
Impact:
Depending on the specific server implementation, or the security devices present on the BIG-IP system's server-side before the server, a SYN containing a non-zero acknowledgement number may be rejected. In turn, this may cause connections to fail to establish.
Workaround:
If compatible with your application and specific needs, you can work around this issue by disabling Verified Accept in the TCP profile.
Fix:
SYN segment retransmissions now correctly use 0 as the acknowledgement number.
Fixed Versions:
16.1.0, 15.1.4.1, 14.1.4.5, 13.1.5
935593-2 : Incorrect SYN re-transmission handling with FastL4 timestamp rewrite
Links to More Info: BT935593
Component: Local Traffic Manager
Symptoms:
FastL4 profiles configured with the TCP timestamp rewrite option enabled does not treat retransmitted SYNs in a correct manner.
Conditions:
FastL4 profile with TCP timestamp rewrite option is in use.
Impact:
Timestamp on some TCP packets sent by BIG-IP systems might be incorrect.
Workaround:
Do not use TCP timestamp rewrite.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.5
935293-1 : 'Detected Violation' Field for event logs not showing
Links to More Info: BT935293
Component: Application Security Manager
Symptoms:
Violation is missing/details not populated in the event log page, when a POST request with large number of parameters are sent to the BIG IP system.
Conditions:
-- A large POST request with lots of parameters is sent to BIG-IP system.
-- 'Learn New Parameters' is enabled.
Impact:
You cannot see the violation details.
Workaround:
Disabling parameter learning helps.
Note: This happens only with a large number of parameters. Usually it works as expected.
Fix:
The eventlog is reserving space for violations.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.5
933777-3 : Context use and syntax changes clarification
Links to More Info: BT933777
Component: Application Visibility and Reporting
Symptoms:
There are two context and syntax-related issues:
-- In v14.x, the context for tmsh analytics commands related to server side connections changed. For example, 'total-server-side-conns' became a simple 'server-side-conns'.
-- In v13.x and 14.x, the calculation method for 'max-tps' changed from cumulative to commutative.
Conditions:
This occurs in either of the following scenarios:
-- Using tmsh analytics commands related to max-tps in v13.x or later.
-- Using tmsh analytics commands related to server side connections in BIG-IP v14.x and later.
Impact:
Stats names do not reflect their actual values. The 'max-tps' value is no longer valid for client IP context. These changes might have varied impacts, depending on your configuration.
Workaround:
None
Fix:
-- Label names for tmsh analytics commands related to server side connections changed (for example: the tmsh display name changed from 'total-server-side-conns' to 'server-side-conns', with similar changes for the other server side connection stats).
-- The 'max-tps' formula changed to be commutative instead of cumulative, so it is no longer relevant in the 'client-ip' context.
Behavior Change:
-- Label names for tmsh analytics commands related to server side connections changed (for example: the tmsh display name changed from 'total-server-side-conns' to 'server-side-conns', with similar changes for the other server side connection stats).
-- The 'max-tps' formula changed to be commutative instead of cumulative, so it is no longer relevant in the 'client-ip' context.
Fixed Versions:
16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4
933461-2 : BGP multi-path candidate selection does not work properly in all cases.
Links to More Info: BT933461
Component: TMOS
Symptoms:
ZebOS BGP might not properly clear the multi-path candidate flag when handling a BGP route.
Conditions:
An inbound route-map exists that modifies a route's path selection attribute.
Impact:
Incorrect path selection and/or a timer on a route getting refreshed every time the Routing Information Base (RIB) is scanned.
Workaround:
None.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3
932485-1 : Incorrect sum(hits_count) value in aggregate tables
Links to More Info: BT932485
Component: Application Visibility and Reporting
Symptoms:
If the results gathered for sum(hits_count) are very large (e.g., 15000300000), the system does not report the correct values in the AVR tables.
Conditions:
-- Insert a very large amount of data (approximately 4.5 milliard or more) to one of AVR tables.
-- Review the value of the sum(hits_count) column.
Impact:
The system reports incorrect values in AVR tables when dealing with large numbers
Workaround:
None.
Fixed Versions:
17.0.0, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
932137-3 : AVR data might be restored from non-relevant files in /shared/avr_afm partition during upgrade
Links to More Info: BT932137
Component: Application Visibility and Reporting
Symptoms:
After upgrade, AFM statistics show non-relevant data.
Conditions:
BIG-IP system upgrade
-- Leftovers files remain in /shared/avr_afm partition from other versions.
Impact:
Non-relevant data are shown in AFM statistics.
Workaround:
Delete the non-relevant data manually from MariaDB/MySQL.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5
932133-4 : Payloads with large number of elements in XML take a lot of time to process
Links to More Info: BT932133
Component: Application Security Manager
Symptoms:
ASM experiences high CPU and latency usage while processing a large XML request.
Conditions:
-- ASM provisioned
-- HTTP request with a large XML payload (several MB) is sent to the backend server which triggers the XML parser.
Impact:
High CPU and latency occurs while bd processes the payload. This may cause a bottleneck for different requests that arrive concurrently with the large XML payload request.
Workaround:
None
Fix:
This fix includes performance improvements for large XML payloads.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5
930741-4 : Truncated or incomplete upload of a BIG-IP image causes kernel lockup and reboot
Links to More Info: BT930741
Component: TMOS
Symptoms:
If there is a truncated BIG-IP software image in /shared/images, a kernel lockup and reboot could occur.
One way to have a truncated image in /shared/images is by using iControl/SOAP to upload the image. Using SOAP, the image is uploaded in chunks, so until the last chunk is uploaded, the image is not complete/is truncated.
Conditions:
-- Truncated BIG-IP image in /shared/images
-- Using SOAP to upload the image.
Impact:
Traffic disruption caused by the reboot.
Workaround:
If you are using SOAP to upload BIG-IP software images, upload them to /shared first and then move them to /shared/images.
Fixed Versions:
16.1.0, 15.1.2, 14.1.3.1, 13.1.3.6
929001-5 : ASM form handling improvements
Links to More Info: K48321015, BT929001
Component: Application Security Manager
Symptoms:
Under certain conditions, the ASM form handler may not enforce as expected.
Conditions:
- Brute force protection is configured
Impact:
Enforcement not triggered as expected.
Workaround:
N/A
Fix:
ASM now processes forms as expected.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3, 14.1.4.1, 13.1.4, 12.1.6, 11.6.5.3
928685-4 : ASM Brute Force mitigation not triggered as expected
Links to More Info: K49549213, BT928685
Component: Application Security Manager
Symptoms:
Under certain conditions the Brute Force mitigation will not be triggered.
Conditions:
- ASM enabled
- Brute Force mitigation enabled
Impact:
Brute Force mitigation is not triggered as expected.
Workaround:
The following iRule will look for an issue with the authorization header and will raise an custom violation when this is happening:
when ASM_REQUEST_DONE
{
if { [catch { HTTP::username } ] } {
log local0. "ERROR: bad username";
ASM::raise bad_auth_header_custom_violation
}
}
Fix:
Brute Force mitigation is now triggered as expected.
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.3, 14.1.4.2, 13.1.4.1
927993-5 : Built-in SSL Orchestrator RPM installation failure
Links to More Info: K97501254, BT927993
Component: SSL Orchestrator
Symptoms:
Attempting to install the built-in SSL Orchestrator RPM results in the following error:
Failed to load IApp artifacts from f5-iappslx-ssl-orchestrator: java.lang.IllegalStateException: Failed to post templates to block collection.
Conditions:
In the BIG-IP TMUI, the BIG-IP administrator navigates to the SSL Orchestrator Configuration page. This would automatically invoke the installation of the built-in SSL Orchestrator RPM, resulting in the failure.
Impact:
The built-in SSL Orchestrator RPM is not installed and SSL Orchestrator management is not possible.
Workaround:
Step 1. Run the following commands in the BIG-IP command line:
# Get ID for f5-ssl-orchestrator-dg-data:
id1=$(restcurl shared/iapp/blocks/ | jq -r '.items[] | select(.name == "f5-ssl-orchestrator-dg-data") | .id')
# Get ID for f5-ssl-orchestrator-dg-template:
id2=$(restcurl shared/iapp/blocks/ | jq -r '.items[] | select(.name == "f5-ssl-orchestrator-dg-template") | .id')
# Temporarily unlink the "f5-ssl-orchestrator-dg-data" (id1) dependency on "f5-ssl-orchestrator-dg-template" (id2).
restcurl -X PATCH -d "{\"baseReference\": {\"link\": \"https://localhost/mgmt/shared/iapp/blocks/$id1\"}}" shared/iapp/blocks/$id1
# Remove all SSL Orchestrator block templates.
restcurl shared/iapp/blocks | jq -r '.items[] | select(.state == "TEMPLATE") | select(.name | startswith("f5-ssl-orchestrator")) | .id' | for x in $(cat) ; do restcurl -X DELETE shared/iapp/blocks/$x; done
# Remove the SSL Orchestrator RPM installation references (if any).
restcurl -X DELETE shared/iapp/global-installed-packages/9beb912b-4f1c-3f95-94c3-eb1cbac4ab99
restcurl -X DELETE shared/iapp/installed-packages/9beb912b-4f1c-3f95-94c3-eb1cbac4ab99
---
Step 2. Use the BIG-IP TMUI:
Log in to the TMUI and navigate to SSL Orchestrator > Configuration. This would refresh the related page and install the SSL Orchestrator RPM. Wait for the SSL Orchestrator configuration page to complete loading.
---
Step 3. Run the following commands in the BIG-IP command line:
# Restore the "f5-ssl-orchestrator-dg-data" dependency on "f5-ssl-orchestrator-dg-template".
restcurl -X PATCH -d "{\"baseReference\": {\"link\": \"https://localhost/mgmt/shared/iapp/blocks/$id1\"}}" shared/iapp/blocks/$id2
---
Step 4. Use the BIG-IP TMUI:
Refresh the SSL Orchestrator > Configuration page.
Fix:
Built-in SSL Orchestrator RPM installation failure
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.4, 14.1.3, 13.1.3.6, 12.1.5.3
927941-2 : IPv6 static route BFD does not come up after OAMD restart
Links to More Info: BT927941
Component: TMOS
Symptoms:
The Bidirectional Forwarding Detection (BFD) session for an IPv6 static route is not shown in response to the command:
imish -e "show bfd session"
Conditions:
-- BFD is configured with static route IPv6.
-- Restart the oamd process.
Impact:
BFD session is not shown in 'show bfd session'.
Workaround:
Restart tmrouted:
bigstart restart tmrouted
Fix:
IPv6 static route BFD session now comes up after restarting the oamd process.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.3, 14.1.4, 13.1.3.6
927617-4 : 'Illegal Base64 value' violation is detected for cookies that have a valid base64 value
Links to More Info: BT927617
Component: Application Security Manager
Symptoms:
A valid request that should be passed to the backend server is blocked.
Conditions:
-- A cookie name is defined in Security :: Application Security : Headers : Cookies List :: New Cookie, with Base64 Decoding enabled.
-- The cookie header that contain the valid cookie value is encoded to base64.
Impact:
A request is blocked that should not be.
Workaround:
Disable 'Base64 Decoding' for the desired cookie.
Fix:
Requests with valid base64 encoding cookies are now correctly passed by the enforcer.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, 12.1.5.3, 11.6.5.3
926929-1 : RFC Compliance Enforcement lacks configuration availability
Links to More Info: BT926929
Component: Local Traffic Manager
Symptoms:
Earlier versions contained fixes that enforce several RFC compliance items for HTTP request and response processing by BIG-IP systems. Enforcement for some of these items is unavoidable, but might cause issues for certain applications.
Conditions:
The configuration has a virtual server with an HTTP profile.
Impact:
Some applications that require certain constructions after a header name may not function.
Workaround:
None
Fix:
A configuration item has been introduced to manage RFC-compliance options.
In releases 13.1.4, 14.1.4, 15.1.2.1 and 16.0.1.2 and in subsequent releases in those families, a global flag is used to control the enforcement:
sys db tmm.http.rfc.allowwsheadername
The possible values are "enabled" and "disabled"; the default is "enabled".
In release 16.1.0 and subsequent releases, there are two per-profile options; these have been added to the Configuration Utility's configuration page for HTTP profiles, in the 'Enforcement' section:
-- Enforce RFC Compliance
-- Allow Space Header Name
The following sample output shows how the RFC-compliance and whitespace-enforcement settings might appear in tmsh, if enabled:
(tmos)# list ltm profile http http-wsheader
ltm profile http http-wsheader {
app-service none
defaults-from http
enforcement {
allow-ws-header-name enabled
rfc-compliance enabled
}
proxy-type reverse
}
Fixed Versions:
16.1.0, 16.0.1.2, 15.1.2.1, 14.1.4, 13.1.4
926845-3 : Inactive ASM policies are deleted upon upgrade
Links to More Info: BT926845
Component: Application Security Manager
Symptoms:
Upon upgrade, active ASM policies are preserved, and inactive policies are deleted.
Conditions:
-- Configuration contains active and inactive ASM policies.
-- Upgrade the BIG-IP system to any later version.
-- You can check existing ASM policies in tmsh:
tmsh list asm policy
Impact:
Only the active ASM policies are preserved; the inactive policies are deleted.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
926341-4 : RtIntervalSecs parameter in /etc/avr/avrd.cfg file is reset on version upgrade★
Links to More Info: BT926341
Component: Application Visibility and Reporting
Symptoms:
Unusually high AVR CPU utilization occurs following an upgrade.
Conditions:
-- BIG-IP software upgrade to v13.0.x or later.
-- Running AVR.
Impact:
AVR CPU utilization can be unusually high for an unusually long period of time.
Workaround:
After upgrade manually edit /etc/avr/avrd.cfg to decrease AVR CPU usage is high by increasing the time period of real-time statistics collection. In order to do so:
1. Change value of RtIntervalSecs in /etc/avr/avrd.cfg file to 30 or 60 seconds.
2. Restart the system by running the following command at the command prompt:
bigstart restart.
When changing RtIntervalSecs please take into consideration two important limitations:
-- Value of RtIntervalSecs cannot be less than 10.
-- Value of RtIntervalSecs must be 10 on BIG-IP devices that are registered on BIG-IQ DCD nodes.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.4, 14.1.4.4, 13.1.5
924929 : Logging improvements for VDI plugin
Links to More Info: BT924929
Component: Access Policy Manager
Symptoms:
If the Virtual Desktop Interface (VDI) plugin aborts, the names of the events are not logged in the APM log file.
Conditions:
- Virtual Desktop Interface (VDI) configured
- The plugin encounters a problem and aborts
Impact:
Event names are not displayed in the APM log.
Workaround:
None.
Fix:
Event names along with the exceptions are also seen in the APM log file.
Fixed Versions:
16.1.0, 16.0.1.1, 15.1.2.1, 14.1.3.1, 13.1.3.6
924493-5 : VMware EULA has been updated
Links to More Info: BT924493
Component: TMOS
Symptoms:
The End User License Agreement (EULA) presented in VMware is out of date.
Conditions: