| Package | Affected versions | Patched versions |
|---|---|---|
| arx | ≥ 5.0.0, ≤ 5.3.1≥ 6.0.0, ≤ 6.4.0 | |
| big-ip access policy manager | = 13.0.0≥ 10.1.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2 | |
| big-ip advanced firewall manager | = 13.0.0≥ 11.3.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2 | |
| big-ip analytics | = 13.0.0≥ 11.0.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2 | |
| big-ip application acceleration manager | = 13.0.0≥ 11.4.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2 | |
| big-ip application security manager | = 13.0.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2≥ 9.2.0, ≤ 9.4.8 | |
| big-ip edge gateway | ≥ 10.1.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0 | |
| big-ip link controller | = 13.0.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2≥ 9.2.2, ≤ 9.4.8 | |
| big-ip local traffic manager | = 13.0.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2≥ 9.0.0, ≤ 9.6.1 | |
| big-ip policy enforcement manager | = 13.0.0≥ 11.3.0, ≤ 11.6.1≥ 12.0.0, ≤ 12.1.2 | |
| big-ip protocol security module | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.4.1≥ 9.4.5, ≤ 9.4.8 | |
| big-ip wan optimization manager | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0 | |
| big-ip webaccelerator | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0≥ 9.4.0, ≤ 9.4.8 | |
| firepass | = 7.0.0≥ 6.0.0, ≤ 6.1.0 |
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free