PT-2024-6531 · Juniper Networks · Junos+1

Published 2024-06-25 · Updated 2025-01-07 · CVE-2024-39532

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.2R3-S9 Junos OS versions 21.4 prior to 21.4R3-S9 Junos OS versions 22.2 prior to 22.2R2-S1, 22.2R3 Junos OS versions 22.3 prior to 22.3R1-S1, 22.3R2 Junos OS Evolved versions prior to 22.1R3-EVO Junos OS Evolved versions 22.2-EVO prior to 22.2R2-S1-EVO, 22.2R3-EVO Junos OS Evolved versions 22.3-EVO prior to 22.3R1-S1-EVO, 22.3R2-EVO

Description: The issue is related to the disclosure of sensitive information through log files in Juniper Networks Junos OS and Junos OS Evolved. A local, authenticated attacker with high privileges can access sensitive information when another user performs a specific operation, causing the sensitive information to be stored as plain text in a specific log file.

Recommendations: For Junos OS versions prior to 21.2R3-S9, update to version 21.2R3-S9 or later. For Junos OS versions 21.4 prior to 21.4R3-S9, update to version 21.4R3-S9 or later. For Junos OS versions 22.2 prior to 22.2R2-S1, 22.2R3, update to version 22.2R2-S1, 22.2R3 or later. For Junos OS versions 22.3 prior to 22.3R1-S1, 22.3R2, update to version 22.3R1-S1, 22.3R2 or later. For Junos OS Evolved versions prior to 22.1R3-EVO, update to version 22.1R3-EVO or later. For Junos OS Evolved versions 22.2-EVO prior to 22.2R2-S1-EVO, 22.2R3-EVO, update to version 22.2R2-S1-EVO, 22.2R3-EVO or later. For Junos OS Evolved versions 22.3-EVO prior to 22.3R1-S1-EVO, 22.3R2-EVO, update to version 22.3R1-S1-EVO, 22.3R2-EVO or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-07673

CVE-2024-39532

Affected Products

Junos

Junos Evolved

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-39532 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39532 · Vendor Advisory
• https://supportportal.juniper.net/JSA82992 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07673 · Security Note
• https://supportportal.juniper.net/s/article/2024-07-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Confidential-information-in-logs-can-be-accessed-by-another-user-CVE-2024-39532?language=en_US · Note
• https://twitter.com/CVEnew/status/1811440417264505333 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811470732792041890 · Twitter Post