For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Aurel's avatar
Aurel
Icon for Cirrus rankCirrus
Mar 26, 2019

ASM: Wrong charset on policy, what's the impact ?

Hello,   An UTF-8 encoding/charset application is protected by ASM, on which the policy has been set to another one : iso-8859-15.   I am considering to set a new policy with the proper charset...
ASM Advanced WAF
security
Erik_Novak's avatar
Erik_Novak
Icon for Employee rankEmployee
Mar 28, 2019

You are better off creating a new policy with the new character set. For both UTF-8 and iso8859-15 encodings, undefined characters will be disallowed and you will get a failed to convert character violation, even if some of the lower characters have the same encoding. However, if configured with ISO-8859-8 and receiving UTF-8 data, ASM will try to understand the stream both as ISO-8859-8 and if it fails, will also try UTF-8. IF you absolutely can't change the application language, is it possible to selectively disable the attack signature being triggered?