Sign-up

ID

VAR-202210-1146


CVE

CVE-2022-22219


TITLE

Juniper Networks  Junos OS  and  Junos OS Evolved  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-019221

DESCRIPTION

Due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved, an attacker in direct control of a BGP client connected to a route reflector, or via a machine in the middle (MITM) attack, can send a specific EVPN route contained within a BGP Update, triggering a routing protocol daemon (RPD) crash, leading to a Denial of Service (DoS) condition. Continued receipt and processing of these specific EVPN routes could create a sustained Denial of Service (DoS) condition. This issue only occurs on BGP route reflectors, only within a BGP EVPN multicast environment, and only when one or more BGP clients have 'leave-sync-route-oldstyle' enabled. This issue affects: Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S2; 21.4 versions prior to 21.4R2-S2, 21.4R3; 22.1 versions prior to 22.1R1-S2, 22.1R3; 22.2 versions prior to 22.2R2. Juniper Networks Junos OS Evolved 21.3 version 21.3R1-EVO and later versions prior to 21.4R3-EVO; 22.1 versions prior to 22.1R1-S2-EVO, 22.1R3-EVO; 22.2 versions prior to 22.2R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 21.3R1. Juniper Networks Junos OS Evolved versions prior to 21.3R1-EVO

Trust: 1.71

sources: NVD: CVE-2022-22219 // JVNDB: JVNDB-2022-019221 // VULHUB: VHN-409748

AFFECTED PRODUCTS

vendor:junipermodel:junos os evolvedscope:eqversion:22.2

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:21.3

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:22.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:21.4

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:22.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:21.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:22.1

Trust: 1.0

vendor:ジュニパーネットワークスmodel:junos osscope: - version: -

Trust: 0.8

vendor:ジュニパーネットワークスmodel:junos os evolvedscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-019221 // NVD: CVE-2022-22219

CVSS

SEVERITY

CVSSV2

CVSSV3

sirt@juniper.net: CVE-2022-22219
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2022-019221
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202210-1173
value: MEDIUM

Trust: 0.6

sirt@juniper.net: CVE-2022-22219
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.1

Trust: 1.0

OTHER: JVNDB-2022-019221
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-019221 // CNNVD: CNNVD-202210-1173 // NVD: CVE-2022-22219

PROBLEMTYPE DATA

problemtype:CWE-241

Trust: 1.0

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-019221 // NVD: CVE-2022-22219

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-1173

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202210-1173

PATCH

title:Juniper Networks Junos OS and Junos OS Evolved Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=211027

Trust: 0.6

sources: CNNVD: CNNVD-202210-1173

EXTERNAL IDS

db:NVDid:CVE-2022-22219

Trust: 3.3

db:JUNIPERid:JSA69898

Trust: 2.5

db:JVNDBid:JVNDB-2022-019221

Trust: 0.8

db:AUSCERTid:ESB-2022.5667

Trust: 0.6

db:CNNVDid:CNNVD-202210-1173

Trust: 0.6

db:VULHUBid:VHN-409748

Trust: 0.1

sources: VULHUB: VHN-409748 // JVNDB: JVNDB-2022-019221 // CNNVD: CNNVD-202210-1173 // NVD: CVE-2022-22219

REFERENCES

url:https://kb.juniper.net/jsa69898

Trust: 2.5

url:https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/ref/statement/evpn-edit-routing-instances-protocols.html

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22219

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-22219/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.5667

Trust: 0.6

sources: VULHUB: VHN-409748 // JVNDB: JVNDB-2022-019221 // CNNVD: CNNVD-202210-1173 // NVD: CVE-2022-22219

SOURCES

db:VULHUBid:VHN-409748
db:JVNDBid:JVNDB-2022-019221
db:CNNVDid:CNNVD-202210-1173
db:NVDid:CVE-2022-22219

LAST UPDATE DATE

2024-08-14T15:06:05.820000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-409748date:2022-10-21T00:00:00
db:JVNDBid:JVNDB-2022-019221date:2023-10-24T08:20:00
db:CNNVDid:CNNVD-202210-1173date:2022-11-09T00:00:00
db:NVDid:CVE-2022-22219date:2022-10-21T18:12:04.983

SOURCES RELEASE DATE

db:VULHUBid:VHN-409748date:2022-10-18T00:00:00
db:JVNDBid:JVNDB-2022-019221date:2023-10-24T00:00:00
db:CNNVDid:CNNVD-202210-1173date:2022-10-18T00:00:00
db:NVDid:CVE-2022-22219date:2022-10-18T03:15:09.577