K46901953 : BIG-IP APM virtual server vulnerability CVE-2020-5874

Security Advisory Description

In certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management Microkernel(TMM). (CVE-2020-5874)

Impact

An attacker may be able to perform a denial-of-service (DoS) attack on a BIG-IP system by causing the TMM process to restart.

The data plane is only impacted and exposed when the virtual server is configured to use OpenID connect. The control plane is not impacted by this vulnerability.