CVE-2017-6165

Critical

Published: 20/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe versions from 11.5.1 HF6 to 12.1.2 on VIPRION platforms, the script synchronizing SafeNet HSM configuration between blades in a clustered deployment logs the HSM partition password in cleartext to the '/var/log/ltm' log file.

Risk Assessment

Logging the password in cleartext poses a risk of unauthorized access to critical HSM configuration elements, potentially leading to serious data security breaches.

Recommendation

It is recommended to upgrade to the latest software version to mitigate this vulnerability and implement additional log protection measures to prevent the exposure of sensitive information.

Original NVD description (English source)

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0.0 through 12.1.2 on VIPRION platforms only, the script which synchronizes SafeNet External Network HSM configuration elements between blades in a clustered deployment will log the HSM partition password in cleartext to the "/var/log/ltm" log file.