QID 376039

OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).CVE-2020-1971

Vulnerable Component: BIG-IP ASM,LTM,APM

Affected Versions:
16.0.0 - 16.1.1
15.1.0 - 15.1.4
14.1.0 - 14.1.4
13.1.0 - 13.1.4
12.1.0 - 12.1.5
11.6.1 - 11.6.5
16.0.0 - 16.1.0

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

Note: Advisory has different affected versions for different affected products. This QID checks for versions having Management port (CRL checking) as a vulnerable component.

An attacker may cause a NULL pointer dereference and produce a core file, leading to a possible denial-of-service (DOS) attack.