Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
11.5.0, 11.5.1, 11.5.2
Fixed In:
11.6.0, 11.6.0, 11.5.3
Opened: May 16, 2014 Severity: 1-Blocking Related Article:
K16634
Some URIs passed to the BIG-IP system with X-F5 that are not X-F5-REST-Coordination-Id may improperly parse the HTTP request headers. These include iControl-REST URIs /mgmt/tm/analytics/... /mgmt/tm/vcmp/... /mgmt/tm/actions/... /mgmt/tm/gtm/... /mgmt/tm/ltm/... /mgmt/tm/net/... /mgmt/tm/pem/... /mgmt/tm/util/... /mgmt/tm/sys/... /mgmt/tm/cli/... /mgmt/tm/secuirty/... /mgmt/tm/ilx/... /mgmt/tm/apm/... /mgmt/tm/transaction/... /mgmt/tm/auth/... /mgmt/tm/wom/... /mgmt/tm/cm/... /mgmt/tm/wam/...
Headers are not parsed properly.
Headers prefixed with X-F5 that are not X-F5-REST-Coordination-Id.
None
The system now checks for the full header name to properly parse instead requiring X-F5 to determine whether or not it is the X-F5-REST-Coordination-Id header.