PT-2020-14888 · Juniper Networks · Srx Series+1

Published 2020-10-16 · Updated 2022-01-01 · CVE-2020-1684

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series versions prior to 12.3X48-D105 Juniper Networks Junos OS on SRX Series versions prior to 15.1X49-D221 Juniper Networks Junos OS on SRX Series versions prior to 15.1X49-D230 Juniper Networks Junos OS on SRX Series versions prior to 17.4R3-S3 Juniper Networks Junos OS on SRX Series versions prior to 18.1R3-S11 Juniper Networks Junos OS on SRX Series versions prior to 18.2R3-S3 Juniper Networks Junos OS on SRX Series versions prior to 18.3R2-S4 Juniper Networks Junos OS on SRX Series versions prior to 18.3R3-S2 Juniper Networks Junos OS on SRX Series versions prior to 18.4R2-S5 Juniper Networks Junos OS on SRX Series versions prior to 18.4R3-S1 Juniper Networks Junos OS on SRX Series versions prior to 19.1R2-S2 Juniper Networks Junos OS on SRX Series versions prior to 19.1R3 Juniper Networks Junos OS on SRX Series versions prior to 19.2R1-S5 Juniper Networks Junos OS on SRX Series versions prior to 19.2R2 Juniper Networks Junos OS on SRX Series versions prior to 19.3R3 Juniper Networks Junos OS on SRX Series versions prior to 19.4R2

Description Receipt of specific HTTP traffic can cause high CPU load utilization on Juniper Networks SRX Series configured with application identification inspection enabled. This could lead to traffic interruption. Application identification is enabled by default and is automatically turned on when Intrusion Detection and Prevention (IDP), AppFW, AppQoS, or AppTrack is configured.

Recommendations For versions prior to 12.3X48-D105, update to 12.3X48-D105 or later. For versions prior to 15.1X49-D221, update to 15.1X49-D221 or later. For versions prior to 15.1X49-D230, update to 15.1X49-D230 or later. For versions prior to 17.4R3-S3, update to 17.4R3-S3 or later. For versions prior to 18.1R3-S11, update to 18.1R3-S11 or later. For versions prior to 18.2R3-S3, update to 18.2R3-S3 or later. For versions prior to 18.3R2-S4, update to 18.3R2-S4 or later. For versions prior to 18.3R3-S2, update to 18.3R3-S2 or later. For versions prior to 18.4R2-S5, update to 18.4R2-S5 or later. For versions prior to 18.4R3-S1, update to 18.4R3-S1 or later. For versions prior to 19.1R2-S2, update to 19.1R2-S2 or later. For versions prior to 19.1R3, update to 19.1R3 or later. For versions prior to 19.2R1-S5, update to 19.2R1-S5 or later. For versions prior to 19.2R2, update to 19.2R2 or later. For versions prior to 19.3R3, update to 19.3R3 or later. For versions prior to 19.4R2, update to 19.4R2 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-1684

Affected Products

Junos

Srx Series

References · 3

• https://osv.dev/vulnerability/CVE-2020-1684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1684 · Security Note
• https://kb.juniper.net/JSA11081 · Vendor Advisory