CVE-2024-21597

Опубликовано: 12 янв. 2024

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it's received in the wrong RI context.

This issue affects Juniper Networks Junos OS on MX Series:

All versions earlier than 20.4R3-S9;
21.2 versions earlier than 21.2R3-S3;
21.4 versions earlier than 21.4R3-S5;
22.1 versions earlier than 22.1R3;
22.2 versions earlier than 22.2R3;
22.3 versions earlier than 22.3R2.

Ссылки

https://supportportal.juniper.net/JSA75738
Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Third Party Advisory
https://supportportal.juniper.net/JSA75738
Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:juniper:junos:20.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s4:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s5:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s6:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s7:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:20.4:r3-s8:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:juniper:junos:22.1:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:juniper:junos:22.3:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*

EPSS

Процентиль: 10%

0.00035

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-668

Связанные уязвимости

GHSA-m474-q42g-p73p

CVSS3: 5.3

github

около 2 лет назад

An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it's received in the wrong RI context. This issue affects Juniper Networks Junos OS on MX Series: * All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3; * 22.2 versions earlier than 22.2R3; * 22.3 versions earlier than 22.3R2.

BDU:2024-00444

CVSS3: 7.5

fstec

около 2 лет назад

Уязвимость механизма пересылки пакетов (PFE) операционной системы Juniper Networks Junos, позволяющая нарушителю получить доступ к конфиденциальным данным

EPSS

Процентиль: 10%

0.00035

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-668