PT-2022-5241 · Juniper Networks · Junos

Published 2022-10-12 · Updated 2022-10-21 · CVE-2022-22228

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.1R3-S2 Juniper Networks Junos OS versions prior to 21.2R3-S1 Juniper Networks Junos OS versions prior to 21.3R3 Juniper Networks Junos OS versions prior to 21.4R2 Juniper Networks Junos OS versions prior to 22.1R2

Description The issue is related to an Improper Validation of Specified Type of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS. This vulnerability allows an attacker to cause an RPD memory leak, leading to a Denial of Service (DoS), but only when the attacker's packets are destined to any configured IPv6 address on the device.

Recommendations For Juniper Networks Junos OS version 21.1, update to version 21.1R3-S2 or later. For Juniper Networks Junos OS version 21.2, update to version 21.2R3-S1 or later. For Juniper Networks Junos OS version 21.3, update to version 21.3R3 or later. For Juniper Networks Junos OS version 21.4, update to version 21.4R2 or later. For Juniper Networks Junos OS version 22.1, update to version 22.1R2 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-1287

CWE-20

Related Identifiers

BDU:2022-06519

CVE-2022-22228

Affected Products

Junos

References · 4

• https://osv.dev/vulnerability/CVE-2022-22228 · Vendor Advisory
• https://kb.juniper.net/JSA69880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22228 · Security Note
• https://bdu.fstec.ru/vul/2022-06519 · Security Note