For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sven_Leupold_85's avatar
Sven_Leupold_85
Icon for Cirrus rankCirrus
Jun 05, 2014

This answers some questions: http://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html

 

TMM is not using openssl for SSL enabled virtual servers except you configure COMPAT ciphers on 11.5.x. The risk on the management traffic (configuration/iControl/big3d) is low as long as your management segment is separated.

 

But, still, F5 should provide an official statement that their SSL implementation is not affected.

 

  • Michael_Kenned1's avatar
    Michael_Kenned1
    Icon for Nimbostratus rankNimbostratus
    Jun 05, 2014
    This tool released by redhat is indicating that my F5 sites (which don't use COMPAT ciphers) are affected: https://access.redhat.com/labs/ccsinjectiontest/ I'm eager to hear F5's official response.
  • Sven_Leupold_85's avatar
    Sven_Leupold_85
    Icon for Cirrus rankCirrus
    Jun 06, 2014
    Hello Team, Good Morning. Regarding OpenSSL vulnerability - CVE-2014-0224, F5 Product Development has now assigned ID 465799 (BIG-IP) to this vulnerability. To read more about this vulnerability for versions know to be vulnerable and not vulnerable, please see SOL15325 via the link below. We received a case closed message from F5 pointing to SOL15325: OpenSSL vulnerability - CVE-2014-0224 https://support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.html