CVE-2022-41787 BIG-IP DNS Express vulnerability CVE-2022-41787
Attackers can cause a denial of service by sending specific DNSSEC queries to BIG-IP DNS Express when configured on a virtual server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41787?
CVE-2022-41787 is a high-severity vulnerability in F5 Big-Ip Domain Name System, published on 19 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when DNS profile is configured on a virtual server with DNS Express enabled, undisclosed DNS queries with DNSSEC can cause TMM to terminate.
Weakness: CWE-476
Which versions are affected by CVE-2022-41787?
It affects 2 products.
Products include F5 Big-Ip Domain Name System, F5 Big-Ip Local Traffic Manager.
How do I fix CVE-2022-41787?
No fix has been published for CVE-2022-41787 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41787 being exploited?
There is no known exploitation of CVE-2022-41787 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Ip Domain Name System
Sources
Also known as GHSA-x82j-m6f3-7f78.