For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cathy_123's avatar
cathy_123
Icon for Cirrostratus rankCirrostratus
Jul 18, 2019

how to solve CVE-2019-3855 in F5

HI F5   Our scanner saw we have CVE-2019-3855 vulnerability in our F5 however I cannot see much information regarding this vulnerability in f5.   Our F5 version is 13.1.1.4   Thank you!
Lidev's avatar
Lidev
Icon for Nacreous rankNacreous
Jul 18, 2019

Hello cathy,

 

This CVE target libssh2 vulnerabilty and affected all versions including 1.8.0.

F5 BIG-IP v13.1.1.4 run CentOS 6.8, Linux Kernel 3.10.0 (64-bit kernel only) and use libssh2-1.4.2-2, that's why your scanner raise an alert.

The version 14.1.0/15.0 use libssh2-1.4.3-10 so the upgrade doesn't solve this vulnerabilty.

 

Maybe try to open a F5 support case to see if they can provide you with a hotfix.