PT-2022-2649 · Juniper Networks · Junos

Published 2022-01-12 · Updated 2023-06-27 · CVE-2022-22166

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 20.4 prior to 20.4R3-S1 Juniper Networks Junos OS versions 21.1 prior to 21.1R2-S2, 21.1R3

Description The issue is caused by an improper validation of specified quantity in input in the routing protocol daemon (rpd) of Juniper Networks Junos OS, allowing an unauthenticated networked attacker to cause an rpd crash and thereby a Denial of Service (DoS). This can occur when a BGP update message with a malformed BGP SR-TE policy tunnel attribute is received over an established BGP session and the BGP update tracing flag is enabled. The crash happens as soon as the malformed update is received and does not propagate.

Recommendations For Juniper Networks Junos OS versions 20.4 prior to 20.4R3-S1, update to version 20.4R3-S1 or later. For Juniper Networks Junos OS versions 21.1 prior to 21.1R2-S2, update to version 21.1R2-S2 or later. For Juniper Networks Junos OS version 21.1R3, update to a later version that includes the fix for this issue. As a temporary workaround, consider disabling the BGP update tracing flag until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-1284

CWE-20

Related Identifiers

BDU:2022-03116

CVE-2022-22166

Affected Products

Junos

References · 6

• https://bdu.fstec.ru/vul/2022-03116 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22166 · Vendor Advisory
• https://kb.juniper.net/JSA11274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22166 · Security Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11274&cat=SIRT_1&actp=LIST · Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11274&cat=SIRT_1&actp=LIST · Note