Forum Discussion

Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Nov 05, 2009

SSL Vulnerability

Does anyone know if F5's with SSL Offload are vulnerable to the plain text insertion vulnerability that's been reported today?     Details are vague (As you'd expect) but IIUC it may be on...
config
design
Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Nov 06, 2009
I have an answer from F5.

 

 

The answer itself was specific to 9.4.7, but there's no indication that it's different for any other version (Although I have asked). Because of the way they've implemented it, they're only vulnerable (For SSL Offload) if you have an iRule that explicitly does an SSL::renegotiate.

 

 

They'll be publishing a SOL note in the next few days, possibly with same iRule code to workaround the issue where SSL::renegotiate is necessary.

 

 

H
Related Content