For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Micha__Iwaszko_'s avatar
Micha__Iwaszko_
Icon for Nimbostratus rankNimbostratus
Nov 17, 2010

OpenSSL vulnerability

http://openssl.org/news/secadv_20101116.txt

 

Does anyone know, whether LTMs are affected?

 

config
design

3 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Nov 17, 2010
    All versions of OpenSSL supporting TLS extensions contain this vulnerability

     

    including OpenSSL 0.9.8f through 0.9.8o, 1.0.0, 1.0.0a releases <----------

     

     

    SOL9445: The BIG-IP third party software matrix

     

    https://support.f5.com/kb/en-us/solutions/public/9000/400/sol9445.html?sr=11205917
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Nov 17, 2010
    F5 will issue a formal response to these, along with an assessment. If the openssl on-box is vulnerable, it doesn't necessarily mean that the SSL offload capabilities are vulnerable. I'd open a support case and ask them for an assessment on this. Either way, F5 will provide hot fixes, etc. as needed.

     

     

    -Matt
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Nov 17, 2010
    F5 will issue a formal response to these, along with an assessment. If the openssl on-box is vulnerable, it doesn't necessarily mean that the SSL offload capabilities are vulnerable. I'd open a support case and ask them for an assessment on this. Either way, F5 will provide hot fixes, etc. as needed.

     

     

    -Matt