PT-2020-14886 · Juniper Networks · Junos Evolved+1

Published 2020-10-16 · Updated 2021-10-25 · CVE-2020-1678

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 19.4R2 Juniper Networks Junos OS versions 20.1 prior to 20.1R1-S4, 20.1R2 Juniper Networks Junos OS Evolved versions 19.4 Juniper Networks Junos OS Evolved versions 20.1 prior to 20.1R1-S4-EVO, 20.1R2-EVO Juniper Networks Junos OS Evolved versions 20.2 prior to 20.2R1-EVO

Description The issue is caused by the receipt of specific BGP packets on Juniper Networks Junos OS and Junos OS Evolved platforms with EVPN configured, leading to a slow memory leak. If the memory is exhausted, the rpd process might crash. The memory leak can be detected by executing the "show task memory detail | match policy | match evpn" command multiple times to check if memory (Alloc Blocks value) is increasing.

Recommendations For Juniper Networks Junos OS version 19.4, update to 19.4R2 or later. For Juniper Networks Junos OS version 20.1, update to 20.1R1-S4, 20.1R2 or later. For Juniper Networks Junos OS Evolved version 19.4, update to a version later than 19.4. For Juniper Networks Junos OS Evolved version 20.1, update to 20.1R1-S4-EVO, 20.1R2-EVO or later. For Juniper Networks Junos OS Evolved version 20.2, update to 20.2R1-EVO or later.

Fix

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

CVE-2020-1678

Affected Products

Junos

Junos Evolved

References · 3

• https://kb.juniper.net/JSA11075 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1678 · Security Note