PT-2021-19262 · Juniper Networks · Junos Evolved+1

Published

2021-10-19

·

Updated

2021-10-25

·

CVE-2021-31363

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Junos OS versions 19.2R2 through 19.2R3-S3 Junos OS versions 19.3 through 19.3R2-S6 Junos OS versions 19.3 through 19.3R3-S2 Junos OS versions 19.4 through 19.4R1-S4 Junos OS versions 19.4 through 19.4R2-S4 Junos OS versions 19.4 through 19.4R3-S2 Junos OS versions 20.1 through 20.1R2-S1 Junos OS versions 20.1 through 20.1R3 Junos OS versions 20.2 through 20.2R2-S1 Junos OS versions 20.2 through 20.2R3 Junos OS versions 20.3 through 20.3R1-S2 Junos OS versions 20.3 through 20.3R2 Junos OS Evolved versions prior to 20.1R2-S3-EVO Junos OS Evolved versions 20.3 through 20.3R1-S2-EVO
Description A Loop with Unreachable Exit Condition issue in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause high load on RPD, potentially leading to routing protocol flaps. If a system with sensor-based-stats enabled receives a specific LDP FEC, this can lead to the above condition, creating a sustained Denial of Service (DoS) condition.
Recommendations For Junos OS version 19.2R2, update to version 19.2R3-S3 or later. For Junos OS version 19.3, update to version 19.3R2-S6 or 19.3R3-S2 or later. For Junos OS version 19.4, update to version 19.4R1-S4, 19.4R2-S4, or 19.4R3-S2 or later. For Junos OS version 20.1, update to version 20.1R2-S1 or 20.1R3 or later. For Junos OS version 20.2, update to version 20.2R2-S1 or 20.2R3 or later. For Junos OS version 20.3, update to version 20.3R1-S2 or 20.3R2 or later. For Junos OS Evolved version prior to 20.1R2-S3-EVO, update to version 20.1R2-S3-EVO or later. For Junos OS Evolved version 20.3, update to version 20.3R1-S2-EVO or later.

Fix

DoS

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2021-31363

Affected Products

Junos
Junos Evolved