CVE-2019-6593
MEDIUMBIG-IP 11.5.1-11.5.4, 11.6.1, 12.1.0 - Chosen Ciphertext Attack via CBC Ciphers
Title source: llmDescription
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://support.f5.com/csp/article/K10065173
Scores
CVSS v3
5.9
EPSS
0.0041
EPSS Percentile
61.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-327
Status
published
Products (36)
f5/big-ip_access_policy_manager
11.6.1
f5/big-ip_access_policy_manager
12.1.0
f5/big-ip_access_policy_manager
11.5.1 - 11.5.4
f5/big-ip_advanced_firewall_manager
11.6.1
f5/big-ip_advanced_firewall_manager
12.1.0
f5/big-ip_advanced_firewall_manager
11.5.1 - 11.5.4
f5/big-ip_analytics
11.6.1
f5/big-ip_analytics
12.1.0
f5/big-ip_analytics
11.5.1 - 11.5.4
f5/big-ip_application_security_manager
11.6.1
... and 26 more
Published
Feb 26, 2019
Tracked Since
Feb 18, 2026