ID
VAR-202104-0584
CVE
CVE-2021-0258
TITLE
Pillow Buffer error vulnerability
Trust: 0.6
DESCRIPTION
A vulnerability in the forwarding of transit TCPv6 packets received on the Ethernet management interface of Juniper Networks Junos OS allows an attacker to trigger a kernel panic, leading to a Denial of Service (DoS). Continued receipt and processing of these transit packets will create a sustained Denial of Service (DoS) condition. This issue only occurs when TCPv6 packets are routed through the management interface. Other transit traffic, and traffic destined to the management interface, are unaffected by this vulnerability. This issue was introduced as part of a TCP Parallelization feature added in Junos OS 17.2, and affects systems with concurrent network stack enabled. This feature is enabled by default, but can be disabled (see WORKAROUND section below). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R2-S2, 19.1R3; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R1. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. The operating system provides a secure programming interface and Junos SDK. There is a resource management error vulnerability in Junos OS. A remote attacker can send specially crafted TCPy6 traffic to the system and perform a Denial of Service (Dos) attack. The vulnerability allows a remote attacker to perform a denial of service (Dos) attack
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | juniper | model: | junos | scope: | eq | version: | 17.3 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 18.1 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 17.4 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 19.3 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 18.2 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 19.4 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 19.1 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 18.4 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 19.2 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 17.2 | Trust: 1.0 |
| vendor: | juniper | model: | junos | scope: | eq | version: | 18.3 | Trust: 1.0 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-362 | Trust: 1.1 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Juniper Networks Junos OS Repair measures for the competition condition problem loophole | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=148274 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-0258 | Trust: 1.8 |
| db: | JUNIPER | id: | JSA11149 | Trust: 1.8 |
| db: | CS-HELP | id: | SB2021041363 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202104-975 | Trust: 0.6 |
| db: | CS-HELP | id: | SB2021041602 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.1289 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202104-1024 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-372160 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-0258 | Trust: 0.1 |
REFERENCES
| url: | https://kb.juniper.net/jsa11149 | Trust: 1.8 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021041363 | Trust: 0.6 |
| url: | https://vigilance.fr/vulnerability/junos-os-multiple-vulnerabilities-35081 | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021041602 | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.1289 | Trust: 0.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-0258 | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/362.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-372160 |
| db: | VULMON | id: | CVE-2021-0258 |
| db: | CNNVD | id: | CNNVD-202104-975 |
| db: | CNNVD | id: | CNNVD-202104-1024 |
| db: | NVD | id: | CVE-2021-0258 |
LAST UPDATE DATE
2024-08-14T12:06:51.652000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-372160 | date: | 2021-04-28T00:00:00 |
| db: | VULMON | id: | CVE-2021-0258 | date: | 2021-04-28T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-1024 | date: | 2021-05-07T00:00:00 |
| db: | NVD | id: | CVE-2021-0258 | date: | 2021-04-28T20:34:29.277 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-372160 | date: | 2021-04-22T00:00:00 |
| db: | VULMON | id: | CVE-2021-0258 | date: | 2021-04-22T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-1024 | date: | 2021-04-14T00:00:00 |
| db: | NVD | id: | CVE-2021-0258 | date: | 2021-04-22T20:15:09.597 |