LoadMaster Vulnerabilities
The table below is a list of the security vulnerabilities about which the LoadMaster Support Team gets the most inquires from our customers. If you have a question about a vulnerability not listed below and whether it applies to LMOS, please contact Support.
| CVE Entry / Internal ID |
Affected Libraries |
Fixed Version | Comments |
|
CVE-2023-22809 |
NA | NA |
Not Vulnerable. LoadMaster is a closed appliance and does not provide a general purpose login or CLI that allow the user to execute the 'sudo -e' command. |
|
CVE-2023-22374 |
N/A | N/A |
Not Vulnerable. This exploit leverages a defect in iControl SOAP, an open communications API, specifically on Big-IP systems from F5 Networks. LoadMaster does not use or support iControl SOAP. |
|
CVE-2022-47938 |
N/A | N/A |
Not Vulnerable. LoadMaster does not support the ksmbd binary and so is not vulnerable to this exploit. [Note that Linux servers configured behind LoadMaster remain vulnerable to this exploit and should be updated with the latest Linux kernel patch if they are running a vulnerable kernel release.] |
|
CVE-2022-3786 |
N/A | N/A |
Not Vulnerable. These CVEs describe two high-severity vulnerabilities in OpenSSL version 3.0.6. LoadMaster does not yet support OpenSSL 3 -- running version 1.1.1n as of the date that these vulnerabilities were announced -- and so is not vulnerable to these exploits. Also see this security announcement. |
|
CVE-2022-41040 CVE-2022-41082 |
N/A | N/A |
LoadMaster itself is not vulnerable to these exploits; they are zero day vulnerabilities in Microsoft Exchange 2013, 2016, and 2019. There are, however, steps you can take on LoadMaster to protect your Exchange deployment from them. Please see this knowledge base article for more information. |
| CVE-2022-22965 CVE-2022-22963 CVE-2022-22950 |
N/A | N/A |
Not Vulnerable. LoadMaster does not use any components of the Java Spring Framework. [This is also true of the Kemp 360 Central and Vision products.] |
| CVE-2022-21907 | N/A | N/A |
Partially Vulnerable. This vulnerability exploits a flaw in the Microsoft Windows Server implementation of HTTP trailer headers which may appear at the end of chunked messages. Because trailer headers are not supported on LoadMaster, non-passthrough Layer 7 services on LoadMaster are not susceptible to exploitation of this vulnerability. For passthrough services, the required remediation is to install the latest updates from Microsoft on all vulnerable servers, or turn off trailer header processing on those servers. |
| CVE-2022-21449 | Oracle Java SE Libraries | N/A |
Not Vulnerable. This is a vulnerability in the Oracle Java SE. A successful exploit of this vulnerability can result in unauthorized creation, deletion, or modification of Java SE accessible data. The Oracle Java SE is not present on LoadMaster, which is therefore not vulnerable to this attack. |
| CVE-2022-0778 | OpenSSL | 7.2.56.2 7.2.54.4 7.2.48.7 |
LoadMaster is vulnerable to this exploit. The updates listed at left were released on 25 April 2022 to close this vulnerability by upgrading to the OpenSSL release where this issue is addressed (OpenSSL 1.1.1n). Please see the Release Notes for more detail. |
|
CVE-2021-45080 |
N/A | 7.2.54.3 |
It was possible for a malicious, already authenticated, privileged user to obtain unrestricted access to the VLM disk image and thereby obtain a debug password to the running system. This vulnerability has been closed. |
|
CVE-2021-44228 |
N/A | N/A |
Not Vulnerable. The LoadMaster and GEO products are not vulnerable to this exploit, as Java is not used by either product. [Please note that the KEMP 360 Central and Kemp 360 Vision products also do not use Java.] |
|
CVE-2021-41823 |
N/A | N/A |
LoadMaster is vulnerable to this medium-level exploit. Customers can add a custom rule to the WAF engine to block it. Please see this article. |
|
CVE-2021-41069 |
N/A | 7.2.55.0 |
Validation has been enhanced for the upload of a Virtual Service Template to the system to close a security vulnerability wherein a carefully constructed file can be uploaded as a template and create unwanted files on the filesystem. |
| CVE-2021-41068 | N/A | 7.2.55.0 | The system console has been updated to close vulnerabilities present in previous releases that could allow an already authenticated user to obtain a privileged shell. |
|
CVE-2021-36368 |
N/A | N/A | Not Vulnerable. This requires agent forwarding to be enabled on the target system and I don’t think that’s enabled on LM. Even if it is, the CVE specifically states that in order to exploit this vulnerability, “an attacker has silently modified the server to support the None authentication option”. So, the attacker would already have to possess admin credentials for the LM -- at which point there is nothing any system could do to prevent them from modifying security sensitive options. This exploit is also disputed by the vendor: "this is not an authentication bypass, since nothing is being bypassed." |
| CVE-2021-33910 | N/A | N/A | Not Vulnerable. This requires the ability to install a kernel module and other programs onto the target system, which is not possible on LMOS. |
| CVE-2021-33909 | N/A | N/A | Not Vulnerable. The systemd program is not present on LMOS. |
| CVE-2021-4043 | N/A | N/A | Not Vulnerable. This exploit leverages the pkexec utility, which does not exist on LoadMaster. |
| CVE-2021-3711 | openssl | N/A | Not Vulnerable. The SM2 ciphers that are the subject of this vulnerability are not supported on any release of LoadMaster. |
| CVE-2021-3450 | openssl | N/A | Not Vulnerable. This vulnerability affects OpenSSL version 1.1.1h through 1.1.1j, none of which are supported on any release of LMOS. LMOS 7.2.55 supports OpenSSL 1.1.1k, which closes this vulnerability. |
| CVE-2021-3449 | openssl | LMOS 7.2.55.0 openssl 1.1.1k |
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension, then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). In LMOS 7.2.55, OpenSSL is updated to version 1.1.1k which addresses this issue. Also see this support article. Also note that in LMOS 7.2.55, the default setting for SSL Renegotiation is now disabled. |
| CVE-2021-3156 | Sudoedit Linux | N/A | Not Vulnerable. The sudoedit program is not present on LMOS. |
| CVE-2021-1732 | Windows NETLOGON | N/A | Not Vulnerable. This is Windows-only issue and does not apply to Linux-based systems like LMOS. |
|
CVE-2020-15778 |
N/A |
N/A | Not Vulnerable. LoadMaster currently runs OpenSSH version 8.4p1; this exploit occurs in 8.3p1 and earlier releases. |
| CVE-2020-15598 | ModSecurity v3 | N/A | Not Vulnerable. LMOS uses the ModSecurity v2.9 release line. |
| CVE-2020-8515 | N/A | N/A | Not Vulnerable. |
| CVE-2020-1967 | N/A | N/A | Not Vulnerable. |
| CVE-2020-10029 | Glibc | N/A | Not Vulnerable. |
| PD-13899 | N/A | N/A | Vulnerability concerning ACLs and Real Servers. Real Servers located on networks on which LoadMaster also has an IP address are always allowed to access Virtual Services that also have an IP address on that network interface regardless of all access control list (ACL) settings on LoadMaster. For Layer 7 services, this issue can be worked around using Content Rules. The workaround for other services is to block access for local Real Servers (if desired) on another network device (firewall, switch, router, etc.). |
| CVE-2019-16905 | openssh | 7.7,7.9,8.x- 8.1 | Not Vulnerable. The vulnerable experimental code is not built as part of LMOS. |
| CVE-2019-0190 | openssl | 1.1.1 | Not Vulnerable. Relevant only to an Apache servers. |
| CVE-2019-1551 | openssl | 1.1.1 | Not Vulnerable. This exploit requires a 512-bit random key and the default for LMOS is 2K. |
|
CVE-2019-1549 |
openssl | 1.1.1 | Not Vulnerable. |
| CVE-2019-1563 | openssl | 1.1.1 | Not Vulnerable. LMOS does not support PKCS7 or CMS and it always uses a certificate. |
| CVE-2019-1547 | openssl | 1.1.1 | Not Vulnerable. LMOS only uses the libssl interface, which is indicated to be not vulnerable. |
|
CVE-2016-20012 |
N/A |
N/A | Not Vulnerable. SSH access on LoadMaster is only for local console and xroot access; no security relevant information is leaked to a malicious user using the methods described in the CVE. |
| CVE-2011-1473 | openssl | 1.x |
By default, LoadMaster is not vulnerable to this exploit since renegotiation is disabled by default in 7.2.55 and above (as you noted below). With renegotiation on, LoadMaster is no more vulnerable than any other network appliance running OpenSSL 1.1.1. This CVE is listed as disputed, per this note: It can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment. Therefore, if you enable renegotiation on LM, you need to configure your back-end servers properly to limit renegotiation. |
| CVE-2011-5094 | openssl | 1.x | Not Vulnerable. Mozilla NSS is not present on nor used by LoadMaster. |
| CVE-2003-0001 | N/A | N/A |
Not Vulnerable. This exploit affects the Linux kernel version 2.x.x release series; LoadMaster currently (LMOS 7.2.57) runs with the 4.14.137 kernel. |