Bug ID 1600665: Editing user-defined attack signature with advanced mode rule may be disabled.

Last Modified: Jan 09, 2025

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4

Fixed In:
17.1.2

Opened: Jun 25, 2024

Severity: 4-Minor

Symptoms

Editing a user-defined signature with a rule defined in advanced mode (and which cannot be converted into simple mode) is not enabled, since the Update button remains disabled even when the rule is changed.

Impact

You are unable to save the edited rule.

Conditions

1. Create a user defined attack signature in Security ›› Options : Application Security : Attack Signatures : Attack Signatures List page, with advanced mode rule, which cannot be converted to simple mode: e.g. valuecontent:"%test2dsa%"; 2. Save the signature and open it. In the opened window, change the rule. The Update button is still disabled.

Workaround

Change another field, e.g. Signature type. then save (press Update button). Open again and change back the other field previously modified, and save again.

Fix Information

Advanced rule can be edited.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips