This issue has been fixed in version 20.3R3-S1 / 20.4R3-S1 / 21.1R3-S1 / 21.2R2-S1. Resolution The following applies to affected versions only: Fix the vulnerable software. Versions prior to 20.3R3-S1 / 20.4R3-S1 / 21.1R3-S1 / 21.2R2-S1 are not affected by this issue. The issue has been addressed in the release versions 20.3R3-S1 / 20.4R3-S1 / 21.1R3-S1 / 21.2R2-S1.
CVE-2018-5126 The command 'show ip bgp rib-sync status' can be used to reveal information regarding the status of BGP rib-sync. By calling this command with the 'clear' option and a specific set of CLI parameters the BGP process can be made to crash. If a hacker can control the BGP process during this crash then he can make the BGP process start to send out bogus routes and make the BGP process unreachable for legitimate users. This results in a Denial of Service condition for the router. This issue affects: Juniper Networks Junos OS versions prior to 19.6R2; 20.4 versions prior to 20.4R1; 21.1 versions prior to 21
Juniper Networks Junos OS versions prior to 19.6R2
; 20.4 versions prior to 20.4R1; 21.1 versions prior to 21
This issue has been fixed in version 19.6R2-S3 / 20.4R1-S2 / 21.1R3-S1 / 21.2R2-S1. Resolution The following applies to affected versions only: Fix the vulnerable software. Versions prior to 19.6R2-S3 / 20.4R1-S2 / 21.1R3-S1 / 21.2R2-S1 are not affected by this issue. The issue has been addressed in the release versions 19.6R2-S3, 20.4R1-S2, 21.1R3-S1, and 21.2R2-S1
Description
This issue has been fixed in versions 20.4R1-S1, 21.1R3-S1, and 21.2R2-S1.
An issue was found in Junos OS that could allow a user to crash the BGP process if the attacker can control the BGP process during a crash and is able to send out bogus routes or make the BGP process unreachable. This would lead to a Denial of Service condition for the router and all legitimate users on that router.
The following applies to affected versions only: Fix the vulnerable software. Versions prior to 19.6R2; 20.4 versions prior to 20.4R1; 21.1 versions prior to 21 are not affected by this issue, as they have already been fixed in later versions of Junos OS (versions 19.6R2; 20.4R1; 21). So which version of Junos OS is affected? The following list describes which version of Junos OS is affected:
Juniper Networks Junos OS - Versions before 19.6
Juniper Networks Junos OS - Version 19.6
Juniper Networks Junos OS - Version 20
Juniper Networks Junos OS - Version 20-22
Juniper Networks Junos OS - Version 21
Timeline
Published on: 04/14/2022 16:15:00 UTC
Last modified on: 04/21/2022 09:52:00 UTC