Security readout for executives and security teams
Plain-English summary
Certain F5 BIG-IP 14.1.0 through 14.1.0.5 systems can have traffic-processing services restart when specific SSL traffic reaches a matching virtual server. The issue affects availability of the data plane, not administrative control functions.
Executive priority
Treat as a targeted availability risk for affected F5 traffic paths. Prioritize externally exposed services and high-value applications, but note the supplied evidence does not indicate control-plane compromise or confirmed active exploitation.
Technical view
The affected condition requires BIG-IP 14.1.0-14.1.0.5, a virtual server with a Client SSL profile, session tickets enabled, and DHE cipher suites. Undisclosed SSL traffic may cause TMM to fail and restart. No CVSS, CWE, exploit detail, or patch version is provided in the supplied bundle.
Likely exposure
Exposure appears limited to BIG-IP deployments on versions 14.1.0-14.1.0.5 with Client SSL profiles using both session tickets and DHE cipher suites.
Exploitation context
The bundle does not show CISA KEV listing or other evidence of active exploitation. Public details intentionally omit the triggering SSL traffic specifics, so validation should focus on version and configuration exposure, not reproduction.
Researcher notes
The public bundle gives configuration prerequisites but not triggering traffic details, exploitability metrics, or confirmed fixes. Avoid attempting reproduction against production devices; use configuration review and vendor advisory tracking for validation.
Mitigation direction
- Review F5 advisory K95434410 for fixed versions and supported workarounds.
- Inventory BIG-IP systems running 14.1.0 through 14.1.0.5.
- Prioritize remediation for internet-facing SSL virtual servers matching the affected profile conditions.
- Change SSL profile settings only if supported by F5 guidance and application requirements.
- Monitor for unexpected TMM restarts until remediation is complete.
Validation and detection
- Confirm BIG-IP version is within 14.1.0 through 14.1.0.5.
- Identify virtual servers configured with Client SSL profiles.
- Check whether affected Client SSL profiles have session tickets enabled.
- Check whether those profiles allow DHE cipher suites.
- Review logs and monitoring for TMM fail and restart events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-6629 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.f5.com/csp/article/K95434410CVE reference · x_refsource_CONFIRM
- https://support.f5.com/csp/article/K95434410?utm_source=f5support&%3Butm_medium=RSSCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.