# F5 Rules for AWS WAF - CVE-2021-22118 & CVE-2016-1000027 **URL:** \ **Category:** Technical Forums\ **Tags:** cve, waf, aws, cloud, security, f5-rules-for-aws-waf\ **Created:** [September 14, 2023, 12:28pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091 "2023-09-14T12:28:08Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![chanzk](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@chanzk](https://community.f5.com/u/chanzk)\ **Post date:** [September 14, 2023, 12:28pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/1 "2023-09-14T12:28:08Z")
Hello, We’re checking in the AWS marketplace for the **F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules** and want to check if the following CVEs are covered by this rule set? - CVE-2021-22118: Local Privilege Escalation within Spring Webflux Multipart Request Handling - CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Thanks. ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [September 17, 2023, 12:25am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/2 "2023-09-17T00:25:37Z")
The following is good generic info on the F5 WAF: > **[How does a WAF mitigate vulnerabilities?](https://www.f5.com/company/blog/how-does-a-waf-mitigate-vulnerabilities)** > > How does a WAF mitigate vulnerabilities? Read the F5 blog to learn how web application firewalls provide virtual patching and protect against zero-day threats. You would probably be looking at signatures. You can look at these if you have a test or eval instance running of the product: > **[myF5](https://my.f5.com/manage/s/article/K41207833)** ---
**Author:** ![chanzk](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@chanzk](https://community.f5.com/u/chanzk)\ **Post date:** [September 18, 2023, 4:23am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/3 "2023-09-18T04:23:50Z")
Hi  @whisperer  , Thanks for the reply. As I mentioned, I am using AWS marketplace for the **F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules**. Therefore I do not have access to the BIG-IP ASM/AdvWAF Configuration Utility. Does it mean that it is impossible to check what CVEs are included when subscripting F5 rules from AWS marketplace? Thanks. ---
**Author:** ![PSFletchTheTek](https://avatars.discourse-cdn.com/v4/letter/p/53a042/32.png) [@PSFletchTheTek](https://community.f5.com/u/PSFletchTheTek)\ **Post date:** [September 18, 2023, 9:46am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/4 "2023-09-18T09:46:38Z")
If someone has access to a f5 with WAF you could follow this? > **[myF5](https://my.f5.com/manage/s/article/K45558510)** ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [September 18, 2023, 12:34pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/5 "2023-09-18T12:34:00Z")
I really cannot think of a way to a) programmatically via CLI obtain this information from the product, b) nor am I aware of any online based index or search tool for figuring out what version/signature release covers certain CVEs. If I need a quick answer, I would just run an F5 VE instance on VMware, same BIGIP code and attack signature version, and reference it that way. I would be very interested in knowing of a better way of doing this. Have you tried to contact an F5 sales engineer or product support? ---
**Author:** ![buulam](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/buulam/32/5220_2.png) [@buulam](https://community.f5.com/u/buulam)\ **Post date:** [September 18, 2023, 4:14pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/6 "2023-09-18T16:14:23Z")
Hi  @chanzk  , I’ve asked the Product Manager for the F5 Rules for AWS WAF to review. Will let you know what the response is. Thank you ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [September 19, 2023, 11:37am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/7 "2023-09-19T11:37:50Z")
Hi  @chanzk  , Unlike the full blown WAF security solutions, F5 rules on AWS WAF are limited in total capacity, limiting the types of CVEs we can offer protection against. Normally, F5 rules include protection against CVEs that are common among customers. CVE-2016-1000027 may affect only few, therefore it wasn’t included yet. We will add it in our next updates. CVE-2021-22118 is a local vulnerability, not a network vulnerability. So less relevant for a WAF. Thanks. ---
**Author:** ![chanzk](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@chanzk](https://community.f5.com/u/chanzk)\ **Post date:** [September 20, 2023, 2:43am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/8 "2023-09-20T02:43:34Z")
Hi  @Joel_Cohen  , Thanks very much of the information. That is useful. May I know the schedule of next updates that invlude CVE-2016-1000027? Regards, ---
**Author:** ![chanzk](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@chanzk](https://community.f5.com/u/chanzk)\ **Post date:** [September 21, 2023, 3:18am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/9 "2023-09-21T03:18:27Z")
Hi @Joel_Cohen  , It would be helpful if I could know the schedule of next updates that include CVE-2016-1000027. Thanks. Regards, ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [September 21, 2023, 11:01am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/10 "2023-09-21T11:01:56Z")
Hi  @chanzk  , Apologies for the delayed response- we plan to update it by the first week of October. Thanks, ---
**Author:** ![ambrosetse](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ambrosetse](https://community.f5.com/u/ambrosetse)\ **Post date:** [September 26, 2023, 5:12am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/11 "2023-09-26T05:12:35Z")
Hi  @Joel_Cohen  , Can I ask for the update with CVE-2016-1000027. follow by this thread at October? Thanks ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [September 26, 2023, 3:51pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/12 "2023-09-26T15:51:01Z")
Sure. I’ll set myself a reminder to update this thread 🙂 ---
**Author:** ![ambrosetse](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ambrosetse](https://community.f5.com/u/ambrosetse)\ **Post date:** [October 5, 2023, 6:49am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/13 "2023-10-05T06:49:15Z")
Hi  @Joel_Cohen I would like to know if the rule set is updated or not? ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [October 5, 2023, 8:09am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/14 "2023-10-05T08:09:47Z")
The rule set was updated to include CVE-2016-1000027. ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [October 5, 2023, 8:10am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/15 "2023-10-05T08:10:47Z")
Hi  @ambrosetse Yes it was updated. sorry it took me longer to answer than expected. ---
**Author:** ![ambrosetse](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ambrosetse](https://community.f5.com/u/ambrosetse)\ **Post date:** [October 9, 2023, 4:47am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/16 "2023-10-09T04:47:19Z")
Hi  @Joel_Cohen I would like to know if the current F5 rules for AWS WAF cover for the following vulnerabilities? CVE-2022-22968, CVE-2022-22976, CVE-2022-22970, CVE-2022-22950, CVE-2023-20861 and CVE-2023-20863 If not, will they include at the future release? Thanks Ambrose ---
**Author:** ![Joel\_Cohen](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/joel_cohen/32/20598_2.png) [@Joel\_Cohen](https://community.f5.com/u/Joel_Cohen)\ **Post date:** [October 16, 2023, 9:04am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/17 "2023-10-16T09:04:00Z")
Hi  @ambrosetse  , These CVEs are not covered in the rule sets. We don’t have these in our plans either. Thansk Joel ---
**Author:** ![ambrosetse](https://avatars.discourse-cdn.com/v4/letter/a/f17d59/32.png) [@ambrosetse](https://community.f5.com/u/ambrosetse)\ **Post date:** [January 29, 2024, 1:38am UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/18 "2024-01-29T01:38:42Z")
Hi  @Joel_Cohen I would like to know if the following rule in “**F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules**” protect on the CVE-2016-100027? ![image_327299.jpg](https://d20hrnpixdzcsd.cloudfront.net/optimized/2X/9/9dd015eb75f680d8f16853d9d7ab50cd09e7c2b8_2_690x26.jpeg) If not, which rule will protect on the CVE? Also, I find that the action is “Use action defined in the rule”, I would like to know the default action of the rule is BLOCK or COUNT? ---
**Author:** ![Pradeep\_Kandi](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@Pradeep\_Kandi](https://community.f5.com/u/Pradeep_Kandi)\ **Post date:** [January 31, 2024, 12:52pm UTC](https://community.f5.com/t/f5-rules-for-aws-waf-cve-2021-22118-cve-2016-1000027/73091/19 "2024-01-31T12:52:38Z")
Hi @ambrosetse Yes, the rule you pasted will mitigate the CVE that was mentioned, and the deployed rules’ course of action would be to BLOCK. Hope this helps.