cvelistv5 - cve-2025-21600

cve-2025-21600

Vulnerability from cvelistv5

Published

2025-01-09 16:49

Modified

2025-01-27 22:00

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A/V:C/RE:M/U:Green

Summary

An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects systems configured in either of two ways: * systems with BGP traceoptions enabled * systems with BGP family traffic-engineering (BGP-LS) configured and can be exploited from a directly connected and configured BGP peer. This issue affects iBGP and eBGP with any address family configured, and both IPv4 and IPv6 are affected by this vulnerability. This issue affects: Junos OS: * from 21.4 before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.3 before 22.3R3-S4, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R1-S2, 24.2R2; Junos OS Evolved: * from 21.4-EVO before 21.4R3-S9-EVO, * from 22.2-EVO before 22.2R3-S5-EVO, * from 22.3-EVO before 22.3R3-S4-EVO, * from 22.4-EVO before 22.4R3-S5-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S2-EVO, * from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO. This issue does not affect versions of Junos OS prior to 21.3R1. This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO. This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.

References

▼	URL	Tags
	sirt@juniper.net	https://supportportal.juniper.net/JSA92870

Impacted products

Vendor

Product

Version

▼

Juniper Networks

Junos OS

Version: 21.4   ≤
Version: 22.2   ≤
Version: 22.3   ≤
Version: 22.4   ≤
Version: 23.2   ≤
Version: 23.4   ≤
Version: 24.2   ≤

Juniper Networks

Junos OS Evolved

Version: 21.4-EVO   ≤
Version: 22.2-EVO   ≤
Version: 22.3-EVO   ≤
Version: 22.4-EVO   ≤
Version: 23.2-EVO   ≤
Version: 23.4-EVO   ≤
Version: 24.2-EVO   ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T19:17:42.343288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T19:21:59.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.4R3-S9",
              "status": "affected",
              "version": "21.4",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S5",
              "status": "affected",
              "version": "22.2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S4",
              "status": "affected",
              "version": "22.3",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S5",
              "status": "affected",
              "version": "22.4",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S3",
              "status": "affected",
              "version": "23.2",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S3",
              "status": "affected",
              "version": "23.4",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S2, 24.2R2",
              "status": "affected",
              "version": "24.2",
              "versionType": "semver"
            },
            {
              "lessThan": "21.3R1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.4R3-S9-EVO",
              "status": "affected",
              "version": "21.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S5-EVO",
              "status": "affected",
              "version": "22.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S4-EVO",
              "status": "affected",
              "version": "22.3-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S5-EVO",
              "status": "affected",
              "version": "22.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S3-EVO",
              "status": "affected",
              "version": "23.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S2-EVO",
              "status": "affected",
              "version": "23.4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S2-EVO, 24.2R2-EVO",
              "status": "affected",
              "version": "24.2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "21.3R1-EVO",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "One of the following traceoptions configurations, either at the top level, under [logical-systems], or [routing-instances], is required to be potentially exposed to this issue:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[protocols bgp traceoptions packets detail]\u003cbr\u003e[protocols bgp traceoptions update detail]\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; traceoptions packets detail]\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; traceoptions update detail]\u003cbr\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; neighbor \u0026lt;address\u0026gt; traceoptions packets detail]\u003c/tt\u003e\u003cbr\u003e[protocols bgp group \u0026lt;group-name\u0026gt; neighbor \u0026lt;address\u0026gt; traceoptions update detail]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003e\n\nSystems configured with BGP traffic engineering are also vulnerable to this issue:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[protocols bgp group \u0026lt;name\u0026gt; family traffic-engineering unicast]\u003c/tt\u003e"
            }
          ],
          "value": "One of the following traceoptions configurations, either at the top level, under [logical-systems], or [routing-instances], is required to be potentially exposed to this issue:\n\n[protocols bgp traceoptions packets detail]\n[protocols bgp traceoptions update detail]\n[protocols bgp group \u003cgroup-name\u003e traceoptions packets detail]\n[protocols bgp group \u003cgroup-name\u003e traceoptions update detail]\n[protocols bgp group \u003cgroup-name\u003e neighbor \u003caddress\u003e traceoptions packets detail]\n[protocols bgp group \u003cgroup-name\u003e neighbor \u003caddress\u003e traceoptions update detail]\n\n\n\nSystems configured with BGP traffic engineering are also vulnerable to this issue:\n\n[protocols bgp group \u003cname\u003e family traffic-engineering unicast]"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juniper SIRT would like to acknowledge and thank Craig Dods from Meta\u2019s Infrastructure Security Engineering team for responsibly reporting this vulnerability."
        }
      ],
      "datePublic": "2025-01-08T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\u003cbr\u003e\u003cbr\u003e\n\nThis issue only affects systems configured in\n      either of two ways:\u003cbr\u003e\n    \n    \u003col\u003e\n      \u003cli\u003esystems with BGP traceoptions enabled\u003c/li\u003e\n      \u003cli\u003esystems with BGP family traffic-engineering (BGP-LS)\n          configured\u003c/li\u003e\u003c/ol\u003e\n\n and can be exploited from a directly connected and configured BGP peer.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eThis issue affects iBGP and eBGP \n\nwith \n\nany address family\n\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects:\u003c/p\u003e\u003cp\u003eJunos OS:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\n\nfrom 21.4 before 21.4R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S4,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R2-S3,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4 before 23.4R2-S3,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2 before 24.2R1-S2, 24.2R2;\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eJunos OS Evolved:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 21.4-EVO before 21.4R3-S9-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2-EVO before 22.2R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3-EVO before 22.3R3-S4-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4-EVO before 22.4R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2-EVO before 23.2R2-S3-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4-EVO before 23.4R2-S2-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\u003c/li\u003e\u003c/ul\u003eThis issue does not affect versions of Junos OS prior to 21.3R1.\u003cbr\u003e\n\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\n\n\u003cbr\u003e\u003cbr\u003eThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.\u003cp\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\n\n\nThis issue only affects systems configured in\n      either of two ways:\n\n    \n    \n        *  systems with BGP traceoptions enabled\n\n        *  systems with BGP family traffic-engineering (BGP-LS)\n          configured\n\n\n and can be exploited from a directly connected and configured BGP peer.\u00a0\n\nThis issue affects iBGP and eBGP \n\nwith \n\nany address family\n\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  \n\nfrom 21.4 before 21.4R3-S9,\u00a0\n  *  from 22.2 before 22.2R3-S5,\u00a0\n  *  from 22.3 before 22.3R3-S4,\u00a0\n  *  from 22.4 before 22.4R3-S5,\u00a0\n  *  from 23.2 before 23.2R2-S3,\u00a0\n  *  from 23.4 before 23.4R2-S3,\u00a0\n  *  from 24.2 before 24.2R1-S2, 24.2R2;\u00a0\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n  *  from 21.4-EVO before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2-EVO before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3-EVO before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4-EVO before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2-EVO before 23.2R2-S3-EVO,\u00a0\n  *  from 23.4-EVO before 23.4R2-S2-EVO,\u00a0\n  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue does not affect versions of Junos OS prior to 21.3R1.\n\n\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\n\n\n\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A/V:C/RE:M/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-27T22:00:26.801Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA92870"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue: \u003cbr\u003eJunos OS: 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\u003cbr\u003eJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\u003cbr\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue: \nJunos OS: 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\nJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA92870",
        "defect": [
          "1823612"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-01-08T17:00:00.000Z",
          "value": "Initial Publication"
        },
        {
          "lang": "en",
          "time": "2025-01-27T17:00:00.000Z",
          "value": "Clarified that versions of Junos OS prior to 21.3R1 and Junos OS Evolved prior to 21.3R1-EVO are unaffected."
        }
      ],
      "title": "Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "If BGP traceoptions are enabled, and traffic engineering is not configured, disable BGP traceoptions if they are not being used for active troubleshooting."
            }
          ],
          "value": "If BGP traceoptions are enabled, and traffic engineering is not configured, disable BGP traceoptions if they are not being used for active troubleshooting."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2025-21600",
    "datePublished": "2025-01-09T16:49:42.367Z",
    "dateReserved": "2024-12-26T14:47:11.669Z",
    "dateUpdated": "2025-01-27T22:00:26.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21600\",\"sourceIdentifier\":\"sirt@juniper.net\",\"published\":\"2025-01-09T17:15:18.960\",\"lastModified\":\"2025-01-27T22:15:14.873\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An Out-of-Bounds Read vulnerability in\\n\\nthe routing protocol daemon (rpd) of \\n\\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\\n\\n\\n\\nThis issue only affects systems configured in\\n      either of two ways:\\n\\n    \\n    \\n        *  systems with BGP traceoptions enabled\\n\\n        *  systems with BGP family traffic-engineering (BGP-LS)\\n          configured\\n\\n\\n and can be exploited from a directly connected and configured BGP peer.\u00a0\\n\\nThis issue affects iBGP and eBGP \\n\\nwith \\n\\nany address family\\n\\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\\n\\nThis issue affects:\\n\\nJunos OS:\u00a0\\n\\n\\n\\n  *  \\n\\nfrom 21.4 before 21.4R3-S9,\u00a0\\n  *  from 22.2 before 22.2R3-S5,\u00a0\\n  *  from 22.3 before 22.3R3-S4,\u00a0\\n  *  from 22.4 before 22.4R3-S5,\u00a0\\n  *  from 23.2 before 23.2R2-S3,\u00a0\\n  *  from 23.4 before 23.4R2-S3,\u00a0\\n  *  from 24.2 before 24.2R1-S2, 24.2R2;\u00a0\\n\\n\\n\\n\\nJunos OS Evolved:\u00a0\\n\\n\\n\\n  *  from 21.4-EVO before 21.4R3-S9-EVO,\u00a0\\n  *  from 22.2-EVO before 22.2R3-S5-EVO,\u00a0\\n  *  from 22.3-EVO before 22.3R3-S4-EVO,\u00a0\\n  *  from 22.4-EVO before 22.4R3-S5-EVO,\u00a0\\n  *  from 23.2-EVO before 23.2R2-S3-EVO,\u00a0\\n  *  from 23.4-EVO before 23.4R2-S2-EVO,\u00a0\\n  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\\n\\n\\nThis issue does not affect versions of Junos OS prior to 21.3R1.\\n\\n\\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\\n\\n\\n\\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de lectura fuera de los l\u00edmites en el daemon de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite que un par BGP no autenticado y l\u00f3gicamente adyacente env\u00ede un paquete BGP espec\u00edficamente malformado para provocar que rpd se bloquee y se reinicie, lo que da como resultado una denegaci\u00f3n de servicio (DoS). La recepci\u00f3n y el procesamiento continuos de este paquete crear\u00e1n una condici\u00f3n de denegaci\u00f3n de servicio (DoS) sostenida. Este problema solo afecta a los sistemas configurados de una de estas dos maneras: * sistemas con opciones de rastreo de BGP habilitadas * sistemas con ingenier\u00eda de tr\u00e1fico de la familia BGP (BGP-LS) configurada y que se puede explotar desde un par BGP conectado y configurado directamente. Este problema afecta a iBGP y eBGP con cualquier familia de direcciones configurada, y tanto IPv4 como IPv6 se ven afectados por esta vulnerabilidad. Este problema afecta a: Junos OS: * Todas las versiones anteriores a 21.4R3-S9, * desde 22.2 hasta 22.2R3-S5, * desde 22.3 hasta 22.3R3-S4, * desde 22.4 hasta 22.4R3-S5, * desde 23.2 hasta 23.2R2-S3, * desde 23.4 hasta 23.4R2-S3, * desde 24.2 hasta 24.2R1-S2, 24.2R2; Junos OS Evolved: * Todas las versiones anteriores a 21.4R3-S9-EVO, * desde 22.2 hasta 22.2R3-S5-EVO, * desde 22.3 hasta 22.3R3-S4-EVO, * desde 22.4 hasta 22.4R3-S5-EVO, * desde 23.2 hasta 23.2R2-S3-EVO, * desde 23.4 hasta 23.4R2-S2-EVO, * desde 24.2 hasta 24.2R1-S2-EVO, 24.2R2-EVO. Esta es una vulnerabilidad similar, pero diferente, al problema informado como CVE-2024-39516.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"NONE\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"HIGH\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NO\",\"recovery\":\"AUTOMATIC\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"GREEN\"}}],\"cvssMetricV31\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://supportportal.juniper.net/JSA92870\",\"source\":\"sirt@juniper.net\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21600\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-09T19:17:42.343288Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-09T19:20:19.984Z\"}}], \"cna\": {\"title\": \"Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash\", \"source\": {\"defect\": [\"1823612\"], \"advisory\": \"JSA92870\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Juniper SIRT would like to acknowledge and thank Craig Dods from Meta\\u2019s Infrastructure Security Engineering team for responsibly reporting this vulnerability.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"AUTOMATIC\", \"baseScore\": 7.1, \"Automatable\": \"NO\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A/V:C/RE:M/U:Green\", \"providerUrgency\": \"GREEN\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.4\", \"lessThan\": \"21.4R3-S9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2\", \"lessThan\": \"22.2R3-S5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3\", \"lessThan\": \"22.3R3-S4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4\", \"lessThan\": \"22.4R3-S5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2\", \"lessThan\": \"23.2R2-S3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.4\", \"lessThan\": \"23.4R2-S3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.2\", \"lessThan\": \"24.2R1-S2, 24.2R2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"21.3R1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS Evolved\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.4-EVO\", \"lessThan\": \"21.4R3-S9-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2-EVO\", \"lessThan\": \"22.2R3-S5-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3-EVO\", \"lessThan\": \"22.3R3-S4-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4-EVO\", \"lessThan\": \"22.4R3-S5-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2-EVO\", \"lessThan\": \"23.2R2-S3-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.4-EVO\", \"lessThan\": \"23.4R2-S2-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.2-EVO\", \"lessThan\": \"24.2R1-S2-EVO, 24.2R2-EVO\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"21.3R1-EVO\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-01-08T17:00:00.000Z\", \"value\": \"Initial Publication\"}, {\"lang\": \"en\", \"time\": \"2025-01-27T17:00:00.000Z\", \"value\": \"Clarified that versions of Junos OS prior to 21.3R1 and Junos OS Evolved prior to 21.3R1-EVO are unaffected.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following software releases have been updated to resolve this specific issue: \\nJunos OS: 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\\nJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue: \u003cbr\u003eJunos OS: 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\u003cbr\u003eJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S3-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2025-01-08T17:00:00.000Z\", \"references\": [{\"url\": \"https://supportportal.juniper.net/JSA92870\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If BGP traceoptions are enabled, and traffic engineering is not configured, disable BGP traceoptions if they are not being used for active troubleshooting.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"If BGP traceoptions are enabled, and traffic engineering is not configured, disable BGP traceoptions if they are not being used for active troubleshooting.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Out-of-Bounds Read vulnerability in\\n\\nthe routing protocol daemon (rpd) of \\n\\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\\n\\n\\n\\nThis issue only affects systems configured in\\n      either of two ways:\\n\\n    \\n    \\n        *  systems with BGP traceoptions enabled\\n\\n        *  systems with BGP family traffic-engineering (BGP-LS)\\n          configured\\n\\n\\n and can be exploited from a directly connected and configured BGP peer.\\u00a0\\n\\nThis issue affects iBGP and eBGP \\n\\nwith \\n\\nany address family\\n\\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\\n\\nThis issue affects:\\n\\nJunos OS:\\u00a0\\n\\n\\n\\n  *  \\n\\nfrom 21.4 before 21.4R3-S9,\\u00a0\\n  *  from 22.2 before 22.2R3-S5,\\u00a0\\n  *  from 22.3 before 22.3R3-S4,\\u00a0\\n  *  from 22.4 before 22.4R3-S5,\\u00a0\\n  *  from 23.2 before 23.2R2-S3,\\u00a0\\n  *  from 23.4 before 23.4R2-S3,\\u00a0\\n  *  from 24.2 before 24.2R1-S2, 24.2R2;\\u00a0\\n\\n\\n\\n\\nJunos OS Evolved:\\u00a0\\n\\n\\n\\n  *  from 21.4-EVO before 21.4R3-S9-EVO,\\u00a0\\n  *  from 22.2-EVO before 22.2R3-S5-EVO,\\u00a0\\n  *  from 22.3-EVO before 22.3R3-S4-EVO,\\u00a0\\n  *  from 22.4-EVO before 22.4R3-S5-EVO,\\u00a0\\n  *  from 23.2-EVO before 23.2R2-S3-EVO,\\u00a0\\n  *  from 23.4-EVO before 23.4R2-S2-EVO,\\u00a0\\n  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\\n\\n\\nThis issue does not affect versions of Junos OS prior to 21.3R1.\\n\\n\\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\\n\\n\\n\\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An Out-of-Bounds Read vulnerability in\\n\\nthe routing protocol daemon (rpd) of \\n\\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\u003cbr\u003e\u003cbr\u003e\\n\\nThis issue only affects systems configured in\\n      either of two ways:\u003cbr\u003e\\n    \\n    \u003col\u003e\\n      \u003cli\u003esystems with BGP traceoptions enabled\u003c/li\u003e\\n      \u003cli\u003esystems with BGP family traffic-engineering (BGP-LS)\\n          configured\u003c/li\u003e\u003c/ol\u003e\\n\\n and can be exploited from a directly connected and configured BGP peer.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eThis issue affects iBGP and eBGP \\n\\nwith \\n\\nany address family\\n\\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects:\u003c/p\u003e\u003cp\u003eJunos OS:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\\n\\nfrom 21.4 before 21.4R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S4,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R2-S3,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4 before 23.4R2-S3,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2 before 24.2R1-S2, 24.2R2;\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eJunos OS Evolved:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 21.4-EVO before 21.4R3-S9-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2-EVO before 22.2R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3-EVO before 22.3R3-S4-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4-EVO before 22.4R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2-EVO before 23.2R2-S3-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4-EVO before 23.4R2-S2-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\u003c/li\u003e\u003c/ul\u003eThis issue does not affect versions of Junos OS prior to 21.3R1.\u003cbr\u003e\\n\\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\\n\\n\u003cbr\u003e\u003cbr\u003eThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.\u003cp\u003e\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"One of the following traceoptions configurations, either at the top level, under [logical-systems], or [routing-instances], is required to be potentially exposed to this issue:\\n\\n[protocols bgp traceoptions packets detail]\\n[protocols bgp traceoptions update detail]\\n[protocols bgp group \u003cgroup-name\u003e traceoptions packets detail]\\n[protocols bgp group \u003cgroup-name\u003e traceoptions update detail]\\n[protocols bgp group \u003cgroup-name\u003e neighbor \u003caddress\u003e traceoptions packets detail]\\n[protocols bgp group \u003cgroup-name\u003e neighbor \u003caddress\u003e traceoptions update detail]\\n\\n\\n\\nSystems configured with BGP traffic engineering are also vulnerable to this issue:\\n\\n[protocols bgp group \u003cname\u003e family traffic-engineering unicast]\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"One of the following traceoptions configurations, either at the top level, under [logical-systems], or [routing-instances], is required to be potentially exposed to this issue:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[protocols bgp traceoptions packets detail]\u003cbr\u003e[protocols bgp traceoptions update detail]\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; traceoptions packets detail]\u003cbr\u003e\u003c/tt\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; traceoptions update detail]\u003cbr\u003e\u003ctt\u003e[protocols bgp group \u0026lt;group-name\u0026gt; neighbor \u0026lt;address\u0026gt; traceoptions packets detail]\u003c/tt\u003e\u003cbr\u003e[protocols bgp group \u0026lt;group-name\u0026gt; neighbor \u0026lt;address\u0026gt; traceoptions update detail]\u003c/tt\u003e\u003cbr\u003e\u003cbr\u003e\\n\\nSystems configured with BGP traffic engineering are also vulnerable to this issue:\u003cbr\u003e\u003cbr\u003e\u003ctt\u003e[protocols bgp group \u0026lt;name\u0026gt; family traffic-engineering unicast]\u003c/tt\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\", \"dateUpdated\": \"2025-01-27T22:00:26.801Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21600\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-27T22:00:26.801Z\", \"dateReserved\": \"2024-12-26T14:47:11.669Z\", \"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"datePublished\": \"2025-01-09T16:49:42.367Z\", \"assignerShortName\": \"juniper\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2025-21600

Vulnerability from fkie_nvd

Published

2025-01-09 17:15

Modified

2025-01-27 22:15

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

▼	URL	Tags
	sirt@juniper.net	https://supportportal.juniper.net/JSA92870

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\n\n\nThis issue only affects systems configured in\n      either of two ways:\n\n    \n    \n        *  systems with BGP traceoptions enabled\n\n        *  systems with BGP family traffic-engineering (BGP-LS)\n          configured\n\n\n and can be exploited from a directly connected and configured BGP peer.\u00a0\n\nThis issue affects iBGP and eBGP \n\nwith \n\nany address family\n\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  \n\nfrom 21.4 before 21.4R3-S9,\u00a0\n  *  from 22.2 before 22.2R3-S5,\u00a0\n  *  from 22.3 before 22.3R3-S4,\u00a0\n  *  from 22.4 before 22.4R3-S5,\u00a0\n  *  from 23.2 before 23.2R2-S3,\u00a0\n  *  from 23.4 before 23.4R2-S3,\u00a0\n  *  from 24.2 before 24.2R1-S2, 24.2R2;\u00a0\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n  *  from 21.4-EVO before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2-EVO before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3-EVO before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4-EVO before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2-EVO before 23.2R2-S3-EVO,\u00a0\n  *  from 23.4-EVO before 23.4R2-S2-EVO,\u00a0\n  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue does not affect versions of Junos OS prior to 21.3R1.\n\n\nThis issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.\n\n\n\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de lectura fuera de los l\u00edmites en el daemon de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite que un par BGP no autenticado y l\u00f3gicamente adyacente env\u00ede un paquete BGP espec\u00edficamente malformado para provocar que rpd se bloquee y se reinicie, lo que da como resultado una denegaci\u00f3n de servicio (DoS). La recepci\u00f3n y el procesamiento continuos de este paquete crear\u00e1n una condici\u00f3n de denegaci\u00f3n de servicio (DoS) sostenida. Este problema solo afecta a los sistemas configurados de una de estas dos maneras: * sistemas con opciones de rastreo de BGP habilitadas * sistemas con ingenier\u00eda de tr\u00e1fico de la familia BGP (BGP-LS) configurada y que se puede explotar desde un par BGP conectado y configurado directamente. Este problema afecta a iBGP y eBGP con cualquier familia de direcciones configurada, y tanto IPv4 como IPv6 se ven afectados por esta vulnerabilidad. Este problema afecta a: Junos OS: * Todas las versiones anteriores a 21.4R3-S9, * desde 22.2 hasta 22.2R3-S5, * desde 22.3 hasta 22.3R3-S4, * desde 22.4 hasta 22.4R3-S5, * desde 23.2 hasta 23.2R2-S3, * desde 23.4 hasta 23.4R2-S3, * desde 24.2 hasta 24.2R1-S2, 24.2R2; Junos OS Evolved: * Todas las versiones anteriores a 21.4R3-S9-EVO, * desde 22.2 hasta 22.2R3-S5-EVO, * desde 22.3 hasta 22.3R3-S4-EVO, * desde 22.4 hasta 22.4R3-S5-EVO, * desde 23.2 hasta 23.2R2-S3-EVO, * desde 23.4 hasta 23.4R2-S2-EVO, * desde 24.2 hasta 24.2R1-S2-EVO, 24.2R2-EVO. Esta es una vulnerabilidad similar, pero diferente, al problema informado como CVE-2024-39516."
    }
  ],
  "id": "CVE-2025-21600",
  "lastModified": "2025-01-27T22:15:14.873",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "automatable": "NO",
          "availabilityRequirements": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirements": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirements": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubsequentSystemAvailability": "NOT_DEFINED",
          "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
          "modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnerableSystemAvailability": "NOT_DEFINED",
          "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
          "modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "GREEN",
          "recovery": "AUTOMATIC",
          "safety": "NOT_DEFINED",
          "subsequentSystemAvailability": "LOW",
          "subsequentSystemConfidentiality": "NONE",
          "subsequentSystemIntegrity": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green",
          "version": "4.0",
          "vulnerabilityResponseEffort": "MODERATE",
          "vulnerableSystemAvailability": "HIGH",
          "vulnerableSystemConfidentiality": "NONE",
          "vulnerableSystemIntegrity": "NONE"
        },
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-09T17:15:18.960",
  "references": [
    {
      "source": "sirt@juniper.net",
      "url": "https://supportportal.juniper.net/JSA92870"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "sirt@juniper.net",
      "type": "Secondary"
    }
  ]
}

ghsa-p52f-fg64-jqxw

Vulnerability from github

Published

2025-01-09 18:32

Modified

2025-01-28 00:32

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.1 (High) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:N/R:A/V:C/RE:M/U:Green

Details

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

    *  systems with BGP traceoptions enabled

    *  systems with BGP family traffic-engineering (BGP-LS)
      configured

and can be exploited from a directly connected and configured BGP peer.

This issue affects iBGP and eBGP

with

any address family

configured, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.4R3-S9,
from 22.2 before 22.2R3-S5,
from 22.3 before 22.3R3-S4,
from 22.4 before 22.4R3-S5,
from 23.2 before 23.2R2-S3,
from 23.4 before 23.4R2-S3,
from 24.2 before 24.2R1-S2, 24.2R2;

Junos OS Evolved:

All versions before 21.4R3-S9-EVO,
from 22.2 before 22.2R3-S5-EVO,
from 22.3 before 22.3R3-S4-EVO,
from 22.4 before 22.4R3-S5-EVO,
from 23.2 before 23.2R2-S3-EVO,
from 23.4 before 23.4R2-S2-EVO,
from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.

This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-21600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-09T17:15:18Z",
    "severity": "HIGH"
  },
  "details": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\n\n\nThis issue only affects systems configured in\n      either of two ways:\n\n    \n    \n        *  systems with BGP traceoptions enabled\n\n        *  systems with BGP family traffic-engineering (BGP-LS)\n          configured\n\n\n and can be exploited from a directly connected and configured BGP peer.\u00a0\n\nThis issue affects iBGP and eBGP \n\nwith \n\nany address family\n\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  All versions before 21.4R3-S9,\u00a0\n  *  from 22.2 before 22.2R3-S5,\u00a0\n  *  from 22.3 before 22.3R3-S4,\u00a0\n  *  from 22.4 before 22.4R3-S5,\u00a0\n  *  from 23.2 before 23.2R2-S3,\u00a0\n  *  from 23.4 before 23.4R2-S3,\u00a0\n  *  from 24.2 before 24.2R1-S2, 24.2R2;\u00a0\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n  *  All versions before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2 before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3 before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4 before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2 before 23.2R2-S3-EVO,\u00a0\n  *  from 23.4 before 23.4R2-S2-EVO,\u00a0\n  *  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\n\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.",
  "id": "GHSA-p52f-fg64-jqxw",
  "modified": "2025-01-28T00:32:12Z",
  "published": "2025-01-09T18:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21600"
    },
    {
      "type": "WEB",
      "url": "https://supportportal.juniper.net/JSA92870"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green",
      "type": "CVSS_V4"
    }
  ]
}

wid-sec-w-2025-0031

Vulnerability from csaf_certbund

Published

2025-01-08 23:00

Modified

2025-01-08 23:00

Summary

Juniper JUNOS: Mehrere Schwachstellen ermöglichen Denial of Service und Informationsoffenlegung

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.

Angriff

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service Angriff durchzuführen und um vertrauliche Informationen preiszugeben.

Betroffene Betriebssysteme

- Sonstiges - UNIX

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JUNOS ist das \"Juniper Network Operating System\", das in Juniper Appliances verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren und um vertrauliche Informationen preiszugeben.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0031 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0031.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0031 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0031"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specially-crafted-BGP-update-packet-causes-RPD-crash-CVE-2025-21602"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-traceoptions-are-configured-receipt-of-malformed-BGP-packets-causes-RPD-to-crash-CVE-2025-21598"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-certain-BGP-options-enabled-receipt-of-specifically-malformed-BGP-update-causes-RPD-crash-CVE-2025-21600"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-Evolved-Receipt-of-specifically-malformed-IPv6-packets-causes-kernel-memory-exhaustion-leading-to-Denial-of-Service-CVE-2025-21599"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX1500-SRX4100-SRX4200-Execution-of-low-privileged-CLI-command-results-in-chassisd-crash-CVE-2025-21596"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592"
      }
    ],
    "source_lang": "en-US",
    "title": "Juniper JUNOS: Mehrere Schwachstellen erm\u00f6glichen Denial of Service und Informationsoffenlegung",
    "tracking": {
      "current_release_date": "2025-01-08T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-09T10:12:20.038+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2025-0031",
      "initial_release_date": "2025-01-08T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-01-08T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Juniper JUNOS",
                "product": {
                  "name": "Juniper JUNOS",
                  "product_id": "T040098",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Evolved",
                "product": {
                  "name": "Juniper JUNOS Evolved",
                  "product_id": "T040099",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:evolved"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JUNOS"
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21593",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21593"
    },
    {
      "cve": "CVE-2025-21600",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21600"
    },
    {
      "cve": "CVE-2025-21602",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21602"
    },
    {
      "cve": "CVE-2025-21598",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Juniper JUNOS. Diese Schwachstellen bestehen, weil der Juniper-Tunneltreiber (jtd) den Kernel-Speicher nicht ordnungsgem\u00e4\u00df freigibt, nachdem er nicht mehr ben\u00f6tigt wird, und weil der Routing-Protokoll-D\u00e4mon (rpd) nicht ordnungsgem\u00e4\u00df mit fehlerhaften BGP-Paketen umgeht, wenn die Paketempfangs-Trace-Optionen aktiviert sind, was zu einem Systemabsturz f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen \u0027Denial of Service\u0027-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21598"
    },
    {
      "cve": "CVE-2025-21599",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Juniper JUNOS. Diese Schwachstellen bestehen, weil der Juniper-Tunneltreiber (jtd) den Kernel-Speicher nicht ordnungsgem\u00e4\u00df freigibt, nachdem er nicht mehr ben\u00f6tigt wird, und weil der Routing-Protokoll-D\u00e4mon (rpd) nicht ordnungsgem\u00e4\u00df mit fehlerhaften BGP-Paketen umgeht, wenn die Paketempfangs-Trace-Optionen aktiviert sind, was zu einem Systemabsturz f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen \u0027Denial of Service\u0027-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21599"
    },
    {
      "cve": "CVE-2025-21596",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Juniper JUNOS. Diese Schwachstelle wird durch die unsachgem\u00e4\u00dfe Behandlung von Ausnahmebedingungen in der Befehlszeilenverarbeitung des Befehls show chassis environment pem auf betroffenen Juniper Networks SRX-Ger\u00e4ten verursacht. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21596"
    },
    {
      "cve": "CVE-2025-21592",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS besteht eine Schwachstelle, die auf unzureichende Zugriffskontrollen in der Befehlszeilenschnittstelle zur\u00fcckzuf\u00fchren ist. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen preiszugeben."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21592"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2025-21600

Vulnerability from cvelistv5

fkie_cve-2025-21600

Vulnerability from fkie_nvd

ghsa-p52f-fg64-jqxw

Vulnerability from github

wid-sec-w-2025-0031

Vulnerability from csaf_certbund

Tags

Sightings

Nomenclature