Undisclosed Requests Can Cause TMM Termination for HTTP Analytics and Advanced WAF/ASM

CVE-2024-23805

What is CVE-2024-23805?

The vulnerability involves the Traffic Management Microkernel (TMM) being susceptible to termination due to certain undisclosed requests. This issue arises particularly when the Application Visibility and Reporting module is used, especially with HTTP Analytics profiles that include URLs on virtual servers combined with enabled database variables such as avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI. The BIG-IP Advanced WAF and ASM are also affected under similar circumstances when specific DoS or Bot Defense profiles are configured. It is important to note that by default, the database variables avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI are disabled, thereby requiring careful configuration to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References