F5 Rules for AWS WAF - List of CVE
Hello,
We're checking in the AWS marketplace for the F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules and we can't find the information of which CVE Rules are applied with this subscription.
- Where can we find the information of which CVEs are covered by this Rule set?
- When a new High Risk CVE is identified how long it would take to be added in the Rule set list?
This information is needed so we can take a decision to use or not the solution, shouldn't this be described somewhere?
Thanks in advance.
Hi tkreque I checked with our Product Management on this.
Unlike our traditional, full blown WAF security solutions, the content of F5 for AWS WAF rules is not visible and cannot be viewed. If you are concerned with a specific CVE, you may send us the CVE details and we will check against the F5 rule sets.
Regarding the time to add CVEs, due to limitations from AWS on resources per rule set we cannot commit to a define cadence to update the sets. New CVEs are evaluated individually.