Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner

CVE 2020-5902 Point Release with VS Client Authentication

OTS02
Cirrus
Cirrus

Just upgraded LTMs from version 12.1.3.0.0.378 to 12.1.5.2 Build 0.0.10 Point Release 2.

Have VSs that request Client Authentication, and an iRule that loops through the client certs, and scrutinizes the certificates.

The Point Release delivers the client certificates in a different format than version 12.1.3.0.0. This caused the iRule to reject the certificates.

So if you have a VS that request and examines client certificates, and are going to install a version that fixes CVE 2020-5902, please be aware that you may have to edit you iRule to look for a slightly different format.

2 REPLIES 2

Yes I've encountered this too. I had to change the Irule in my case.

 

K14204621: The X509::subject iRules command now returns the subject of the specified X509 certificat...

 

OTS02
Cirrus
Cirrus

Thank you jaikumar_f5 for article K14204621.