Vulnerability · Published Jan 12, 2023 · Assigned by juniper
CVE-2023-22398Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs
Medium 5.3
In plain English
A medium-severity security flaw in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). When an MPLS ping is performed on BGP LSPs, the RPD might crash. Repeated execution of this operation will lead to a sustained DoS. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S12; 19.1 versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R1-S1, 21.1R2; Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R2-EVO.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 15.1 – before 15.1R7-S1219.1 – before 19.1R3-S919.2 – before 19.2R1-S9, 19.2R3-S519.3 – before 19.3R3-S619.4 – before 19.4R2-S7, 19.4R3-S820.1 – before 20.1R3-S420.2 – before 20.2R3-S520.3 – before 20.3R3-S5 |
| Juniper Networks | Junos OS Evolved | unspecified – before 20.4R3-S4-EVO21.1 – before 21.1R2-EVO |
Weakness: CWE-824 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H