CVE-2002-20001 Denial of service in n/a

What is CVE-2002-20001?

CVE-2002-20001 is a high-severity denial of service vulnerability in F5 Big-Ip Access Policy Manager, published on 11 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Weakness: CWE-400

Which versions are affected by CVE-2002-20001?

It affects 30 products.

Products include Balasys Dheater, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager and 24 more.

How do I fix CVE-2002-20001?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2002-20001 being exploited?

There is no known exploitation of CVE-2002-20001 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jx4r-qc68-xjr5, openSUSE-SU-2024:11905-1, openSUSE-SU-2024:13932-1.