K59197053 : BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651

Security Advisory Description

When an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. (CVE-2022-34651)

Impact

Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote unauthenticated attacker to cause a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.

Note: TLS 1.3 is disabled by default. This vulnerability affects only configurations where TLS 1.3 has been explicitly enabled.