CVE-2019-6648 : Security Advisory and Response

F5 Container Ingress Service version 1.9.0 may expose BIG-IP secrets when DEBUG logging is enabled.

Understanding CVE-2019-6648

In version 1.9.0 of F5 Container Ingress Service, enabling DEBUG logging can lead to the exposure of sensitive BIG-IP secrets in log files.

What is CVE-2019-6648?

This CVE involves the inadvertent inclusion of BIG-IP secrets like SSL Private Keys and Passphrases in log files when provided as inputs through an AS3 Declaration.

The Impact of CVE-2019-6648

The exposure of such critical secrets could lead to unauthorized access and compromise of SSL/TLS encrypted communications.

Technical Details of CVE-2019-6648

F5 Container Ingress Service version 1.9.0 is affected by this vulnerability.

Vulnerability Description

When DEBUG logging is enabled, the log files may contain BIG-IP secrets, including SSL Private Keys and Passphrases.

Affected Systems and Versions

Product: F5 Container Ingress Service
Version: 1.9.0

Exploitation Mechanism

The vulnerability occurs due to the mishandling of sensitive information in log files, potentially accessible to unauthorized users.

Mitigation and Prevention

Immediate action and long-term security practices are crucial to address this issue.

Immediate Steps to Take

Disable DEBUG logging in F5 Container Ingress Service to prevent the exposure of sensitive data.
Regularly monitor log files for any unauthorized access or unusual activities.

Long-Term Security Practices

Implement strict access controls to limit who can view log files containing sensitive information.
Encrypt sensitive data at rest and in transit to prevent unauthorized disclosure.

Patching and Updates

Apply patches or updates provided by F5 to address this vulnerability and enhance the security of the system.