cve-2024-39554
Vulnerability from cvelistv5
Published
2024-07-10 22:32
Modified
2024-08-02 04:26
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Summary
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.  However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition. On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.  Under certain circumstance and with specific timing, this could result in an rpd crash. This issue only affects systems with BGP multipath enabled. This issue affects: Junos OS: * All versions of 21.1 * from 21.2 before 21.2R3-S7, * from 21.4 before 21.4R3-S6, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S2, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2. Junos OS Evolved: * All versions of 21.1-EVO, * All versions of 21.2-EVO, * from 21.4-EVO before 21.4R3-S6-EVO, * from 22.1-EVO before 22.1R3-S5-EVO, * from 22.2-EVO before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-S2-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R2-EVO. Versions of Junos OS before 21.1R1 are unaffected by this vulnerability. Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.
References
sirt@juniper.nethttps://supportportal.juniper.net/JSA83014Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportportal.juniper.net/JSA83014Vendor Advisory
Impacted products
Vendor Product Version
Juniper Networks Junos OS Version: 21.1   ≤
Version: 21.2   ≤
Version: 21.4   ≤
Version: 22.1   ≤
Version: 22.2   ≤
Version: 22.3   ≤
Version: 22.4   ≤
Version: 23.2   ≤
Create a notification for this product.
   Juniper Networks Junos OS Evolved Version: 21.1-EVO   ≤
Version: 21.2-EVO   ≤
Version: 21.4-EVO   ≤
Version: 22.1-EVO   ≤
Version: 22.2-EVO   ≤
Version: 22.3-EVO   ≤
Version: 22.4-EVO   ≤
Version: 23.2-EVO   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:o:juniper:junos:21.1:-:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "junos",
                  vendor: "juniper",
                  versions: [
                     {
                        lessThan: "21.1*",
                        status: "affected",
                        version: "21.1",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.2r3-s7",
                        status: "affected",
                        version: "21.2",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.4r3-s6",
                        status: "affected",
                        version: "21.4",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.1r3-s5",
                        status: "affected",
                        version: "22.1",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.2r3-s3",
                        status: "affected",
                        version: "22.2",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.3r3-s2",
                        status: "affected",
                        version: "22.3",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.4r3",
                        status: "affected",
                        version: "22.4",
                        versionType: "custom",
                     },
                     {
                        lessThan: "23.2r2",
                        status: "affected",
                        version: "23.2",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.1r1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
               {
                  cpes: [
                     "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "junos_os_evolved",
                  vendor: "juniper",
                  versions: [
                     {
                        lessThan: "21.1r1-evo",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.1*-evo",
                        status: "affected",
                        version: "21.1-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.2*-evo",
                        status: "affected",
                        version: "21.2-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "21.4r3-s6-evo",
                        status: "affected",
                        version: "21.4-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.1r3-s5-evo",
                        status: "affected",
                        version: "22.1-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.2r3-s3-evo",
                        status: "affected",
                        version: "22.2-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.3r3-s2-evo",
                        status: "affected",
                        version: "22.3-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "22.4r3-evo",
                        status: "affected",
                        version: "22.4-evo",
                        versionType: "custom",
                     },
                     {
                        lessThan: "23.2r2-evo",
                        status: "affected",
                        version: "23.2-evo",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-39554",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-11T13:09:55.707497Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-11T13:40:38.794Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T04:26:15.931Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://supportportal.juniper.net/JSA83014",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Junos OS",
               vendor: "Juniper Networks",
               versions: [
                  {
                     lessThan: "21.1*",
                     status: "affected",
                     version: "21.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.2R3-S7",
                     status: "affected",
                     version: "21.2",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.4R3-S6",
                     status: "affected",
                     version: "21.4",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.1R3-S5",
                     status: "affected",
                     version: "22.1",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.2R3-S3",
                     status: "affected",
                     version: "22.2",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.3R3-S2",
                     status: "affected",
                     version: "22.3",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.4R3",
                     status: "affected",
                     version: "22.4",
                     versionType: "semver",
                  },
                  {
                     lessThan: "23.2R2",
                     status: "affected",
                     version: "23.2",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.1R1",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Junos OS Evolved",
               vendor: "Juniper Networks",
               versions: [
                  {
                     lessThan: "21.1*-EVO",
                     status: "affected",
                     version: "21.1-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.2*-EVO",
                     status: "affected",
                     version: "21.2-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.4R3-S6-EVO",
                     status: "affected",
                     version: "21.4-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.1R3-S5-EVO",
                     status: "affected",
                     version: "22.1-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.2R3-S3-EVO",
                     status: "affected",
                     version: "22.2-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.3R3-S2-EVO",
                     status: "affected",
                     version: "22.3-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "22.4R3-EVO",
                     status: "affected",
                     version: "22.4-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "23.2R2-EVO",
                     status: "affected",
                     version: "23.2-EVO",
                     versionType: "semver",
                  },
                  {
                     lessThan: "21.1R1-EVO",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A sample BGP multipath configuration is shown below:<br><br><tt>[ protocols bgp group &lt;name&gt; multipath ]</tt>",
                  },
               ],
               value: "A sample BGP multipath configuration is shown below:\n\n[ protocols bgp group <name> multipath ]",
            },
         ],
         datePublic: "2024-07-10T16:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the \n\nRouting Protocol Daemon (rpd)\n\n of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.&nbsp; However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.<br><br>On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.&nbsp; Under certain circumstance and with specific timing, this could result in an rpd crash.<br><br>This issue only affects systems with BGP multipath enabled.<p><br></p><p>This issue affects:</p><p>Junos OS: <br></p><ul><li>All versions of 21.1</li><li>from 21.2 before 21.2R3-S7, </li><li>from 21.4 before 21.4R3-S6, </li><li>from 22.1 before 22.1R3-S5, </li><li>from 22.2 before 22.2R3-S3, </li><li>from 22.3 before 22.3R3-S2, </li><li>from 22.4 before 22.4R3, </li><li>from 23.2 before 23.2R2.</li></ul><p></p><p>Junos OS Evolved: <br></p><ul><li>All versions of 21.1-EVO,</li><li>All versions of 21.2-EVO,</li><li>from 21.4-EVO before 21.4R3-S6-EVO, </li><li>from 22.1-EVO before 22.1R3-S5-EVO, </li><li>from 22.2-EVO before 22.2R3-S3-EVO, </li><li>from 22.3-EVO before 22.3R3-S2-EVO, </li><li>from 22.4-EVO before 22.4R3-EVO, </li><li>from 23.2-EVO before 23.2R2-EVO.</li></ul><br>Versions of Junos OS before 21.1R1 are unaffected by this vulnerability.<br>Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.",
                  },
               ],
               value: "A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the \n\nRouting Protocol Daemon (rpd)\n\n of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.  However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.\n\nOn all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.  Under certain circumstance and with specific timing, this could result in an rpd crash.\n\nThis issue only affects systems with BGP multipath enabled.\n\n\nThis issue affects:\n\nJunos OS: \n\n\n  *  All versions of 21.1\n  *  from 21.2 before 21.2R3-S7, \n  *  from 21.4 before 21.4R3-S6, \n  *  from 22.1 before 22.1R3-S5, \n  *  from 22.2 before 22.2R3-S3, \n  *  from 22.3 before 22.3R3-S2, \n  *  from 22.4 before 22.4R3, \n  *  from 23.2 before 23.2R2.\n\n\n\n\nJunos OS Evolved: \n\n\n  *  All versions of 21.1-EVO,\n  *  All versions of 21.2-EVO,\n  *  from 21.4-EVO before 21.4R3-S6-EVO, \n  *  from 22.1-EVO before 22.1R3-S5-EVO, \n  *  from 22.2-EVO before 22.2R3-S3-EVO, \n  *  from 22.3-EVO before 22.3R3-S2-EVO, \n  *  from 22.4-EVO before 22.4R3-EVO, \n  *  from 23.2-EVO before 23.2R2-EVO.\n\n\n\nVersions of Junos OS before 21.1R1 are unaffected by this vulnerability.\nVersions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.",
            },
         ],
         exploits: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.",
                  },
               ],
               value: "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "PRESENT",
                  attackVector: "NETWORK",
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "LOW",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
                  version: "4.0",
                  vulnAvailabilityImpact: "HIGH",
                  vulnConfidentialityImpact: "NONE",
                  vulnIntegrityImpact: "NONE",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-362",
                     description: "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-07-10T23:23:10.774Z",
            orgId: "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            shortName: "juniper",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://supportportal.juniper.net/JSA83014",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "The following software releases have been updated to resolve this specific issue:<br>Junos OS: 21.2R3-S7, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, 23.4R1, and all subsequent releases.<br>Junos OS Evolved: 21.4R3-S6-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.<br>",
                  },
               ],
               value: "The following software releases have been updated to resolve this specific issue:\nJunos OS: 21.2R3-S7, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, 23.4R1, and all subsequent releases.\nJunos OS Evolved: 21.4R3-S6-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.",
            },
         ],
         source: {
            advisory: "JSA83014",
            defect: [
               "1744801",
            ],
            discovery: "USER",
         },
         title: "Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash",
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "There are no known workarounds for this issue.",
                  },
               ],
               value: "There are no known workarounds for this issue.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8cbe9d5a-a066-4c94-8978-4b15efeae968",
      assignerShortName: "juniper",
      cveId: "CVE-2024-39554",
      datePublished: "2024-07-10T22:32:34.310Z",
      dateReserved: "2024-06-25T15:12:53.246Z",
      dateUpdated: "2024-08-02T04:26:15.931Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-39554\",\"sourceIdentifier\":\"sirt@juniper.net\",\"published\":\"2024-07-10T23:15:11.607\",\"lastModified\":\"2025-02-07T20:01:23.347\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the \\n\\nRouting Protocol Daemon (rpd)\\n\\n of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.  However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.\\n\\nOn all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.  Under certain circumstance and with specific timing, this could result in an rpd crash.\\n\\nThis issue only affects systems with BGP multipath enabled.\\n\\n\\nThis issue affects:\\n\\nJunos OS: \\n\\n\\n  *  All versions of 21.1\\n  *  from 21.2 before 21.2R3-S7, \\n  *  from 21.4 before 21.4R3-S6, \\n  *  from 22.1 before 22.1R3-S5, \\n  *  from 22.2 before 22.2R3-S3, \\n  *  from 22.3 before 22.3R3-S2, \\n  *  from 22.4 before 22.4R3, \\n  *  from 23.2 before 23.2R2.\\n\\n\\n\\n\\nJunos OS Evolved: \\n\\n\\n  *  All versions of 21.1-EVO,\\n  *  All versions of 21.2-EVO,\\n  *  from 21.4-EVO before 21.4R3-S6-EVO, \\n  *  from 22.1-EVO before 22.1R3-S5-EVO, \\n  *  from 22.2-EVO before 22.2R3-S3-EVO, \\n  *  from 22.3-EVO before 22.3R3-S2-EVO, \\n  *  from 22.4-EVO before 22.4R3-EVO, \\n  *  from 23.2-EVO before 23.2R2-EVO.\\n\\n\\n\\nVersions of Junos OS before 21.1R1 are unaffected by this vulnerability.\\nVersions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Una ejecución concurrente que utiliza un recurso compartido con una vulnerabilidad de sincronización inadecuada ('condición de ejecución'), el daemon de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Juniper Networks Junos OS Evolved, permite a un atacante basado en red no autenticado inyectar actualizaciones de enrutamiento incrementales cuando BGP multipath está habilitado, lo que provoca que rpd se bloquee y se reinicie, lo que resulta en una denegación de servicio (DoS). Dado que se trata de una cuestión de tiempo (condición de ejecución), la explotación exitosa de esta vulnerabilidad está fuera del control del atacante. Sin embargo, la recepción y el procesamiento continuo de este paquete pueden crear una condición sostenida de Denegación de Servicio (DoS). En todas las plataformas Junos OS y Junos OS Evolved con rutas múltiples BGP habilitadas, un cálculo de rutas múltiples específico elimina el siguiente salto original de las rutas principales de rutas múltiples nexthop-set. Cuando ocurre este cambio, la ruta múltiple depende de cierta sincronización interna para registrar la actualización. Bajo ciertas circunstancias y con un momento específico, esto podría resultar en una falla del RPD. Este problema solo afecta a los sistemas con rutas múltiples BGP habilitadas. Este problema afecta a: Junos OS: * Todas las versiones de 21.1 * desde 21.2 anterior a 21.2R3-S7, * desde 21.4 anterior a 21.4R3-S6, * desde 22.1 anterior a 22.1R3-S5, * desde 22.2 anterior a 22.2R3-S3, * desde 22.3 antes de 22.3R3-S2, * de 22.4 antes de 22.4R3, * de 23.2 antes de 23.2R2. Junos OS Evolved: * Todas las versiones de 21.1-EVO, * Todas las versiones de 21.2-EVO, * desde 21.4-EVO antes de 21.4R3-S6-EVO, * desde 22.1-EVO antes de 22.1R3-S5-EVO, * desde 22.2- EVO antes de 22.2R3-S3-EVO, * desde 22.3-EVO antes de 22.3R3-S2-EVO, * desde 22.4-EVO antes de 22.4R3-EVO, * desde 23.2-EVO antes de 23.2R2-EVO. Las versiones de Junos OS anteriores a 21.1R1 no se ven afectadas por esta vulnerabilidad. Las versiones de Junos OS evolucionadas anteriores a 21.1R1-EVO no se ven afectadas por esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"NONE\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"21.1\",\"versionEndExcluding\":\"21.2\",\"matchCriteriaId\":\"68A7F0FD-618E-4C53-92DD-52ECFC317D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"216E7DDE-453D-481F-92E2-9F8466CDDA3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A52AF794-B36B-43A6-82E9-628658624B0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3998DC76-F72F-4452-9150-652140B113EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"36ED4552-2420-45F9-B6E4-6DA2B2B12870\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C28A14E7-7EA0-4757-9764-E39A27CFDFA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A43752D-A4AF-4B4E-B95B-192E42883A5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"42986538-E9D0-4C2E-B1C4-A763A4EE451B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE22CA01-EA7E-4EE5-B59F-EE100688C1DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E596ABD9-6ECD-48DC-B770-87B7E62EA345\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"71745D02-D226-44DC-91AD-678C85F5E6FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39E44B09-7310-428C-8144-AE9DB0484D1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*\",\"matchCriteriaId\":\"53938295-8999-4316-9DED-88E24D037852\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2307BF56-640F-49A8-B060-6ACB0F653A61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*\",\"matchCriteriaId\":\"737DDF96-7B1D-44E2-AD0F-E2F50858B2A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"79ED3CE8-CC57-43AB-9A26-BBC87816062D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4310D2D9-A8A6-48F8-9384-0A0692A1E1C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9962B01C-C57C-4359-9532-676AB81CE8B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"62178549-B679-4902-BFDB-2993803B7FCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AD697DF-9738-4276-94ED-7B9380CD09F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"09FF5818-0803-4646-A386-D7C645EE58A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2229FA59-EB24-49A2-85CE-F529A8DE6BA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CB280D8-C5D8-4B51-A879-496ACCDE4538\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F3F54F1-75B3-400D-A735-2C27C8CEBE79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"476A49E7-37E9-40F9-BF2D-9BBFFAA1DFFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A5B196A-2AF1-4AE5-9148-A75A572807BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B457616-2D91-4913-9A7D-038BBF8F1F66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*\",\"matchCriteriaId\":\"C470FB4E-A927-4AF3-ACB0-AD1E264218B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D157211-535E-4B2D-B2FE-F697FAFDF65C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F96EBE9-2532-4E35-ABA5-CA68830476A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4D936AE-FD74-4823-A824-2D9F24C25BFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E117E493-F4E1-4568-88E3-F243C74A2662\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"01E3E308-FD9C-4686-8C35-8472A0E99F0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3683A8F5-EE0E-4936-A005-DF7F6B75DED3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B615DBA-8C53-41D4-B264-D3EED8578471\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3124DD0-9E42-4896-9060-CB7DD07FC342\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"44F6FD6C-03AF-4D2C-B411-A753DE12A2DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D49FFB60-BA71-4902-9404-E67162919ADC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r3-s3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFF72FCA-C440-4D43-9BDB-F712DB413717\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.1:r3-s4:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE69E9E3-00FC-41BF-9109-617668CF9A0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"06156CD6-09D3-4A05-9C5E-BC64A70640F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E949B21B-AD62-4022-9088-06313277479E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D862E6F-0D01-4B25-8340-888C30F75A2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F28F73E-8563-41B9-A313-BBAAD5B57A67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E37D4694-C80B-475E-AB5B-BB431F59C5E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EC0D2D2-4922-4675-8A2C-57A08D7BE334\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EC91F9D-DEDA-46B4-A39F-59A2CDB86C2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"591AA3E6-62A2-4A1A-A04C-E808F71D8B6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"786F993E-32CB-492A-A7CC-A7E4F48EA8B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"60CEA89D-BAC4-41CD-A1D1-AA5EDDEBD54A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEB98E3F-B0A9-488F-ACFC-56B9485E7C9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"19519212-51DD-4448-B115-8A20A40192CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CC9909E-AE9F-414D-99B1-83AA04D5297B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDE9E767-4713-4EA2-8D00-1382975A4A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"59DDA54E-6845-47EB-AE3C-5EC6BD33DFA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"574730B0-56C8-4A03-867B-1737148ED9B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"20EBC676-1B26-4A71-8326-0F892124290A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB4C0FBF-8813-44E5-B71A-22CBAA603E2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.3:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8BCDE58C-80CC-4C5A-9667-8A4468D8D76C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1379EF30-AF04-4F98-8328-52A631F24737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"28E42A41-7965-456B-B0AF-9D3229CE4D4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB1A77D6-D3AD-481B-979C-8F778530B175\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A064B6B-A99B-4D8D-A62D-B00C7870BC30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"40813417-A938-4F74-A419-8C5188A35486\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FC1BA1A-DF0E-4B15-86BA-24C60E546732\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBB967BF-3495-476D-839A-9DBFCBE69F91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A78CC80-E8B1-4CDA-BB35-A61833657FA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B3B2FE1-C228-46BE-AC76-70C2687050AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1B16FF0-900F-4AEE-B670-A537139F6909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B227E831-30FF-4BE1-B8B2-31829A5610A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"21.1\",\"versionEndExcluding\":\"21.3\",\"matchCriteriaId\":\"2662215B-7A9B-4A99-AFAF-E2BAA58201AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E907193-075E-45BC-9257-9607DB790D71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B73A41D-3FF5-4E53-83FF-74DF58E0D6C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEDF46A8-FC3A-4779-B695-2CA11D045AEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"39809219-9F87-4583-9DAD-9415DD320B36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB299492-A919-4EBA-A62A-B3CF02FC0A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"74ED0939-D5F8-4334-9838-40F29DE3597F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6937069-8C19-4B01-8415-ED7E9EAE2CE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"97DB6DD5-F5DD-4AE1-AF2F-8DB9E18FF882\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"21DF05B8-EF7E-422F-8831-06904160714C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"492FCE45-68A1-4378-85D4-C4034FE0D836\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3:*:*:*:*:*:*\",\"matchCriteriaId\":\"522114CC-1505-4205-B4B8-797DE1BD833B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9D664AB-0FA7-49C7-B6E1-69C77652FBEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DB01252-2F11-41DB-9023-C74FD723334E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C16434C0-21A7-4CE5-92E1-7D60A35EF5D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"750FE748-82E7-4419-A061-2DEA26E35309\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"236E23E5-8B04-4081-9D97-7300DF284000\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FC96EA7-90A7-4838-B95D-60DBC88C7BC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"97541867-C52F-40BB-9AAE-7E87ED23D789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"85CF6664-E35A-4E9B-95C0-CDC91F7F331A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E048A05D-882F-4B1C-BA32-3BBA3FEA31A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E8D51D-1424-4B07-B036-E3E195F21AC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F3C82ED-5728-406F-ACF6-D7411B0AB6C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1475A58F-1515-4492-B5A3-BE40C30E5B14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.1:r3-s4:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9C133A-6114-495F-872C-BD1200953131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3CA3365-F9AF-40DF-8700-30AD4BC58E27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D77A072D-350A-42F2-8324-7D3AC1711BF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"83AE395C-A651-4568-88E3-3600544BF799\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7FEFD0A-A969-4F53-8668-1231FD675D6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3BE1FD4-DAD9-4357-A2E9-20E5826B0D5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"81CC3480-4B65-4588-8D46-FA80A8F6D143\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7E76F5F-DB37-4B7F-9247-3CEB4EBD7696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C63DBEE5-B0C2-498F-A672-B6596C89B0A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9370C46D-3AA1-4562-B67F-DF6EA10F209B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD8C240-A7FE-4FD5-ADCC-289C1BC461BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE2EF84D-55A9-41DC-A324-69E1DC426D0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"433631CA-3AC4-4D66-9B46-AEA4209347F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E4CD8AD-277A-4FC5-A102-3E151060C216\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BC09BAC-83E7-48CE-B571-ED49277B2987\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA4481D2-F693-48A5-8DBC-E86430987A25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"136CA584-2475-4A14-9771-F367180201D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4546776C-A657-42E3-9A36-47F9F59A88AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r3:*:*:*:*:*:*\",\"matchCriteriaId\":\"156DD8ED-CE6E-48C0-9E67-16B04767D62E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.3:r3-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"10F9C2B1-BD81-4EDC-ADF5-4B0F39001C7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A33C425-921F-4795-B834-608C8F1597E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"93887799-F62C-4A4A-BCF5-004D0B4D4154\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62C473D2-2612-4480-82D8-8A24D0687BBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FB4C5CA-A709-4B13-A9E0-372098A72AD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"04CE952D-E3C1-4B34-9E65-EC52BFE887AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AE9D1A7-4721-4E1D-B965-FDC38126B1DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8643AA3-29EF-48A7-B033-CB60988E214B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DEAA7FD-385F-4221-907E-65ABC16BE4BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDEC008A-3137-48D1-8ABC-6DB0EFC40E50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*\",\"matchCriteriaId\":\"558D234D-BC50-415F-86D6-8E19D6C3ACE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*\",\"matchCriteriaId\":\"33F4EEEE-77E9-4973-A770-99E7BA2F05F5\"}]}]}],\"references\":[{\"url\":\"https://supportportal.juniper.net/JSA83014\",\"source\":\"sirt@juniper.net\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://supportportal.juniper.net/JSA83014\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39554\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-11T13:09:55.707497Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:juniper:junos:21.1:-:*:*:*:*:*:*\"], \"vendor\": \"juniper\", \"product\": \"junos\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.1\", \"lessThan\": \"21.1*\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.2\", \"lessThan\": \"21.2r3-s7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.4\", \"lessThan\": \"21.4r3-s6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.1\", \"lessThan\": \"22.1r3-s5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.2\", \"lessThan\": \"22.2r3-s3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.3\", \"lessThan\": \"22.3r3-s2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.4\", \"lessThan\": \"22.4r3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23.2\", \"lessThan\": \"23.2r2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"21.1r1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*\"], \"vendor\": \"juniper\", \"product\": \"junos_os_evolved\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"21.1r1-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.1-evo\", \"lessThan\": \"21.1*-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.2-evo\", \"lessThan\": \"21.2*-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"21.4-evo\", \"lessThan\": \"21.4r3-s6-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.1-evo\", \"lessThan\": \"22.1r3-s5-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.2-evo\", \"lessThan\": \"22.2r3-s3-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.3-evo\", \"lessThan\": \"22.3r3-s2-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"22.4-evo\", \"lessThan\": \"22.4r3-evo\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23.2-evo\", \"lessThan\": \"23.2r2-evo\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-11T13:33:53.541Z\"}}], \"cna\": {\"title\": \"Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash\", \"source\": {\"defect\": [\"1744801\"], \"advisory\": \"JSA83014\", \"discovery\": \"USER\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.1\", \"lessThan\": \"21.1*\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.2\", \"lessThan\": \"21.2R3-S7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.4\", \"lessThan\": \"21.4R3-S6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.1\", \"lessThan\": \"22.1R3-S5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2\", \"lessThan\": \"22.2R3-S3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3\", \"lessThan\": \"22.3R3-S2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4\", \"lessThan\": \"22.4R3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2\", \"lessThan\": \"23.2R2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"21.1R1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS Evolved\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.1-EVO\", \"lessThan\": \"21.1*-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.2-EVO\", \"lessThan\": \"21.2*-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.4-EVO\", \"lessThan\": \"21.4R3-S6-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.1-EVO\", \"lessThan\": \"22.1R3-S5-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2-EVO\", \"lessThan\": \"22.2R3-S3-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3-EVO\", \"lessThan\": \"22.3R3-S2-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4-EVO\", \"lessThan\": \"22.4R3-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2-EVO\", \"lessThan\": \"23.2R2-EVO\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"21.1R1-EVO\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following software releases have been updated to resolve this specific issue:\\nJunos OS: 21.2R3-S7, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, 23.4R1, and all subsequent releases.\\nJunos OS Evolved: 21.4R3-S6-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue:<br>Junos OS: 21.2R3-S7, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, 23.4R1, and all subsequent releases.<br>Junos OS Evolved: 21.4R3-S6-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.<br>\", \"base64\": false}]}], \"datePublic\": \"2024-07-10T16:00:00.000Z\", \"references\": [{\"url\": \"https://supportportal.juniper.net/JSA83014\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There are no known workarounds for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"There are no known workarounds for this issue.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the \\n\\nRouting Protocol Daemon (rpd)\\n\\n of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.\\u00a0 However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.\\n\\nOn all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.\\u00a0 Under certain circumstance and with specific timing, this could result in an rpd crash.\\n\\nThis issue only affects systems with BGP multipath enabled.\\n\\n\\nThis issue affects:\\n\\nJunos OS: \\n\\n\\n  *  All versions of 21.1\\n  *  from 21.2 before 21.2R3-S7, \\n  *  from 21.4 before 21.4R3-S6, \\n  *  from 22.1 before 22.1R3-S5, \\n  *  from 22.2 before 22.2R3-S3, \\n  *  from 22.3 before 22.3R3-S2, \\n  *  from 22.4 before 22.4R3, \\n  *  from 23.2 before 23.2R2.\\n\\n\\n\\n\\nJunos OS Evolved: \\n\\n\\n  *  All versions of 21.1-EVO,\\n  *  All versions of 21.2-EVO,\\n  *  from 21.4-EVO before 21.4R3-S6-EVO, \\n  *  from 22.1-EVO before 22.1R3-S5-EVO, \\n  *  from 22.2-EVO before 22.2R3-S3-EVO, \\n  *  from 22.3-EVO before 22.3R3-S2-EVO, \\n  *  from 22.4-EVO before 22.4R3-EVO, \\n  *  from 23.2-EVO before 23.2R2-EVO.\\n\\n\\n\\nVersions of Junos OS before 21.1R1 are unaffected by this vulnerability.\\nVersions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the \\n\\nRouting Protocol Daemon (rpd)\\n\\n of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.&nbsp; However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.<br><br>On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.&nbsp; Under certain circumstance and with specific timing, this could result in an rpd crash.<br><br>This issue only affects systems with BGP multipath enabled.<p><br></p><p>This issue affects:</p><p>Junos OS: <br></p><ul><li>All versions of 21.1</li><li>from 21.2 before 21.2R3-S7, </li><li>from 21.4 before 21.4R3-S6, </li><li>from 22.1 before 22.1R3-S5, </li><li>from 22.2 before 22.2R3-S3, </li><li>from 22.3 before 22.3R3-S2, </li><li>from 22.4 before 22.4R3, </li><li>from 23.2 before 23.2R2.</li></ul><p></p><p>Junos OS Evolved: <br></p><ul><li>All versions of 21.1-EVO,</li><li>All versions of 21.2-EVO,</li><li>from 21.4-EVO before 21.4R3-S6-EVO, </li><li>from 22.1-EVO before 22.1R3-S5-EVO, </li><li>from 22.2-EVO before 22.2R3-S3-EVO, </li><li>from 22.3-EVO before 22.3R3-S2-EVO, </li><li>from 22.4-EVO before 22.4R3-EVO, </li><li>from 23.2-EVO before 23.2R2-EVO.</li></ul><br>Versions of Junos OS before 21.1R1 are unaffected by this vulnerability.<br>Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"A sample BGP multipath configuration is shown below:\\n\\n[ protocols bgp group <name> multipath ]\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A sample BGP multipath configuration is shown below:<br><br><tt>[ protocols bgp group &lt;name&gt; multipath ]</tt>\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\", \"dateUpdated\": \"2024-07-10T23:23:10.774Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-39554\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-11T13:40:38.794Z\", \"dateReserved\": \"2024-06-25T15:12:53.246Z\", \"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"datePublished\": \"2024-07-10T22:32:34.310Z\", \"assignerShortName\": \"juniper\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.