PT-2023-3055 · Juniper Networks · Junos

Published

2023-01-11

·

Updated

2023-01-24

·

CVE-2023-22414

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 20.2R3-S6 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 20.3R3-S6 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 20.4R3-S4 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 21.1R3-S3 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 21.2R3-S1 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 21.3R3 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 21.4R3 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 22.1R2 Juniper Networks Junos OS PTX Series and QFX10000 Series versions prior to 22.2R2
Description A Missing Release of Memory after Effective Lifetime vulnerability in Flexible PIC Concentrator (FPC) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker from the same shared physical or logical network, to cause a heap memory leak and leading to FPC crash. On all Junos PTX Series and QFX10000 Series, when specific EVPN VXLAN Multicast packets are processed, an FPC heap memory leak is observed. The FPC memory usage can be monitored using the CLI command "show heap extensive".
Recommendations For versions prior to 20.2R3-S6, update to 20.2R3-S6 or later. For versions prior to 20.3R3-S6, update to 20.3R3-S6 or later. For versions prior to 20.4R3-S4, update to 20.4R3-S4 or later. For versions prior to 21.1R3-S3, update to 21.1R3-S3 or later. For versions prior to 21.2R3-S1, update to 21.2R3-S1 or later. For versions prior to 21.3R3, update to 21.3R3 or later. For versions prior to 21.4R3, update to 21.4R3 or later. For versions prior to 22.1R2, update to 22.1R2 or later. For versions prior to 22.2R2, update to 22.2R2 or later.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2023-03122
CVE-2023-22414

Affected Products

Junos