PT-2021-12983 · Juniper Networks · Junos Evolved

Published 2021-10-19 · Updated 2021-10-25 · CVE-2021-0297

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions prior to 20.3R2-S1-EVO Juniper Networks Junos OS Evolved versions 20.4 prior to 20.4R2-EVO Juniper Networks Junos OS Evolved versions 21.1 prior to 21.1R2-EVO

Description: A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured with MD5 authentication to succeed, even if the peer does not have TCP MD5 authentication enabled. This could lead to untrusted or unauthorized sessions being established, resulting in an impact on confidentiality or stability of the network.

Recommendations: For versions prior to 20.3R2-S1-EVO, update to 20.3R2-S1-EVO or later. For versions 20.4 prior to 20.4R2-EVO, update to 20.4R2-EVO or later. For versions 21.1 prior to 21.1R2-EVO, update to 21.1R2-EVO or later.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2021-0297

Affected Products

Junos Evolved

References · 4

• https://osv.dev/vulnerability/CVE-2021-0297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0297 · Security Note
• https://kb.juniper.net/JSA11211 · Vendor Advisory
• https://t.me/cibsecurity/30819 · Telegram Post