Chosen Ciphertext Attack Vulnerability in BIG-IP by F5 Networks

CVE-2019-6593

Summary

On specific versions of BIG-IP by F5 Networks, a virtual server set up with a Client SSL profile is exposed to a vulnerability that allows an attacker to conduct a chosen ciphertext attack against CBC ciphers. This flaw can enable an attacker to recover plaintext from encrypted messages through a man-in-the-middle (MITM) attack, all without needing access to the server's private key. The affected versions include BIG-IP 11.5.1 to 11.5.4, 11.6.1, and 12.1.0, raising serious concerns regarding data confidentiality and integrity.

References