cvelistv5 - cve-2025-21598

CVE-2025-21598 (GCVE-0-2025-21598)

Vulnerability from cvelistv5

Published

2025-01-09 18:16

Modified

2025-01-09 20:15

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber

CWE

CWE-125 - Out-of-bounds Read
Denial of Service (DoS)

Summary

An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd. This issue affects: Junos OS: * from 21.2R3-S8 before 21.2R3-S9, * from 21.4R3-S7 before 21.4R3-S9, * from 22.2R3-S4 before 22.2R3-S5, * from 22.3R3-S2 before 22.3R3-S4, * from 22.4R3 before 22.4R3-S5, * from 23.2R2 before 23.2R2-S2, * from 23.4R1 before 23.4R2-S1, * from 24.2R1 before 24.2R1-S1, 24.2R2. Junos OS Evolved: * from 21.4R3-S7-EVO before 21.4R3-S9-EVO, * from 22.2R3-S4-EVO before 22.2R3-S5-EVO, * from 22.3R3-S2-EVO before 22.3R3-S4-EVO, * from 22.4R3-EVO before 22.4R3-S5-EVO, * from 23.2R2-EVO before 23.2R2-S2-EVO, * from 23.4R1-EVO before 23.4R2-S1-EVO, * from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO. This issue requires a BGP session to be established. This issue can propagate and multiply through multiple ASes until reaching vulnerable devices. This issue affects iBGP and eBGP. This issue affects IPv4 and IPv6. An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue: For example, by issuing the command on the neighboring device: show log messages Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating: rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>) and rpd[<pid>]: Malformed Attribute

References

►

URL

Tags

	sirt@juniper.net	https://supportportal.juniper.net/JSA92867
	sirt@juniper.net	https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html

Impacted products

Vendor

Product

Version

►

Juniper Networks

Junos OS

Version: 21.2R3-S8   ≤
Version: 21.4R3-S7   ≤
Version: 22.2R3-S4   ≤
Version: 22.3R3-S2   ≤
Version: 22.4R3   ≤
Version: 23.2R2   ≤
Version: 23.4R1   ≤
Version: 24.2R1   ≤

Juniper Networks

Junos OS Evolved

Version: 21.4R3-S7-EVO
Version: 22.2R3-S4-EVO   ≤
Version: 22.3R3-S2-EVO   ≤
Version: 22.4R3-EVO   ≤
Version: 23.2R2-EVO   ≤
Version: 23.4R1-EVO   ≤
Version: 24.2R1-EVO   ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T20:14:41.822272Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T20:15:00.238Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "BGP Traceoptions",
            "BGP",
            "RPD"
          ],
          "packageName": "RPD",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.2R3-S9",
              "status": "affected",
              "version": "21.2R3-S8",
              "versionType": "semver"
            },
            {
              "lessThan": "21.4R3-S9",
              "status": "affected",
              "version": "21.4R3-S7",
              "versionType": "semver"
            },
            {
              "lessThan": "22.2R3-S5",
              "status": "affected",
              "version": "22.2R3-S4",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S4",
              "status": "affected",
              "version": "22.3R3-S2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S5",
              "status": "affected",
              "version": "22.4R3",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S2",
              "status": "affected",
              "version": "23.2R2",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S1",
              "status": "affected",
              "version": "23.4R1",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S1, 24.2R2",
              "status": "affected",
              "version": "24.2R1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "21.4R3-S9-EVO",
              "status": "affected",
              "version": "21.4R3-S7-EVO",
              "versionType": "se"
            },
            {
              "lessThan": "22.2R3-S5-EVO",
              "status": "affected",
              "version": "22.2R3-S4-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.3R3-S4-EVO",
              "status": "affected",
              "version": "22.3R3-S2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S5-EVO",
              "status": "affected",
              "version": "22.4R3-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S2-EVO",
              "status": "affected",
              "version": "23.2R2-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S1-EVO",
              "status": "affected",
              "version": "23.4R1-EVO",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S2-EVO, 24.2R2-EVO",
              "status": "affected",
              "version": "24.2R1-EVO",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue can occur when bgp trace options are enabled at global, group, or neighbor-level.\u003cbr\u003e\u003cbr\u003eThe following global example is provided:\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag update detail]\u003cbr\u003eor\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag receive detail]\u003cbr\u003eand\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag update detail]\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag receive detail]\u003cbr\u003e\u003cbr\u003eThe following neighbor-level example is provided:\u003cbr\u003e\u0026nbsp; [protocols bgp group test neighbor 192.168.1.1 traceoptions flag update detail]\u003cbr\u003e\u0026nbsp; [protocols bgp group test neighbor 192.168.1.1 traceoptions flag receive detail]\u003cbr\u003e\u003cbr\u003eRefer to your product documentation for other examples and configurations."
            }
          ],
          "value": "This issue can occur when bgp trace options are enabled at global, group, or neighbor-level.\n\nThe following global example is provided:\n\u00a0 [protocols bgp traceoptions flag update detail]\nor\n\u00a0 [protocols bgp traceoptions flag receive detail]\nand\n\u00a0 [protocols bgp traceoptions flag update detail]\n\u00a0 [protocols bgp traceoptions flag receive detail]\n\nThe following neighbor-level example is provided:\n\u00a0 [protocols bgp group test neighbor 192.168.1.1 traceoptions flag update detail]\n\u00a0 [protocols bgp group test neighbor 192.168.1.1 traceoptions flag receive detail]\n\nRefer to your product documentation for other examples and configurations."
        }
      ],
      "datePublic": "2025-01-08T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn\u0026nbsp;Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u0026nbsp;malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cp\u003eThis issue affects:\u003c/p\u003e\u003cp\u003eJunos OS:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 21.2R3-S8 before 21.2R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 21.4R3-S7 before 21.4R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2R3-S4 before 22.2R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3R3-S2 before 22.3R3-S4,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4R3 before 22.4R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2R2 before 23.2R2-S2,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4R1 before 23.4R2-S1,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2R1 before 24.2R1-S1, 24.2R2.\u003c/li\u003e\u003c/ul\u003eJunos OS Evolved:\u003cbr\u003e\u003cul\u003e\u003cli\u003efrom 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4R3-EVO before 22.4R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2R2-EVO before 23.2R2-S2-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4R1-EVO before 23.4R2-S1-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue requires a BGP session to be established.\u003cbr\u003e\u003cbr\u003eThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\u003cbr\u003e\u003cbr\u003eThis issue affects iBGP and eBGP.\u003cbr\u003e\u003cbr\u003eThis issue affects IPv4 and IPv6.\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003eAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\u003cbr\u003e\u003cbr\u003eFor example, by issuing the command on the neighboring device:\u003cbr\u003e\u0026nbsp;show log messages\u003cbr\u003e\u003cbr\u003eReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\u003cbr\u003e\u0026nbsp; rpd[\u0026lt;pid\u0026gt;]: Received malformed update from \u0026lt;IP address\u0026gt; (External AS \u0026lt;AS#\u0026gt;)\u003cbr\u003eand\u003cbr\u003e\u0026nbsp; rpd[\u0026lt;pid\u0026gt;]: Malformed Attribute\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "An\u00a0Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u00a0malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  from 21.2R3-S8 before 21.2R3-S9,\u00a0\n  *  from 21.4R3-S7 before 21.4R3-S9,\u00a0\n  *  from 22.2R3-S4 before 22.2R3-S5,\u00a0\n  *  from 22.3R3-S2 before 22.3R3-S4,\u00a0\n  *  from 22.4R3 before 22.4R3-S5,\u00a0\n  *  from 23.2R2 before 23.2R2-S2,\u00a0\n  *  from 23.4R1 before 23.4R2-S1,\u00a0\n  *  from 24.2R1 before 24.2R1-S1, 24.2R2.\n\n\nJunos OS Evolved:\n  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4R3-EVO before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2R2-EVO before 23.2R2-S2-EVO,\u00a0\n  *  from 23.4R1-EVO before 23.4R2-S1-EVO,\u00a0\n  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue requires a BGP session to be established.\n\nThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\n\nThis issue affects iBGP and eBGP.\n\nThis issue affects IPv4 and IPv6.\n\nAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\n\nFor example, by issuing the command on the neighboring device:\n\u00a0show log messages\n\nReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\n\u00a0 rpd[\u003cpid\u003e]: Received malformed update from \u003cIP address\u003e (External AS \u003cAS#\u003e)\nand\n\u00a0 rpd[\u003cpid\u003e]: Malformed Attribute"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-09T18:16:32.549Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA92867"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue:\u003cbr\u003e\u003cbr\u003eJunos OS: 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.\u003cbr\u003e\u003cbr\u003eJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S1-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.\n\nJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S1-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA92867",
        "defect": [
          "1821241"
        ],
        "discovery": "USER"
      },
      "title": "Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Disabling packet tracing options will work around this issue.\u003cbr\u003e\u003cbr\u003eThere are no other available workarounds for this issue.\u003cbr\u003e"
            }
          ],
          "value": "Disabling packet tracing options will work around this issue.\n\nThere are no other available workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2025-21598",
    "datePublished": "2025-01-09T18:16:32.549Z",
    "dateReserved": "2024-12-26T14:47:11.669Z",
    "dateUpdated": "2025-01-09T20:15:00.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21598\",\"sourceIdentifier\":\"sirt@juniper.net\",\"published\":\"2025-01-09T19:15:20.123\",\"lastModified\":\"2025-01-09T19:15:20.123\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An\u00a0Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u00a0malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\\nThis issue affects:\\n\\nJunos OS:\u00a0\\n\\n\\n\\n  *  from 21.2R3-S8 before 21.2R3-S9,\u00a0\\n  *  from 21.4R3-S7 before 21.4R3-S9,\u00a0\\n  *  from 22.2R3-S4 before 22.2R3-S5,\u00a0\\n  *  from 22.3R3-S2 before 22.3R3-S4,\u00a0\\n  *  from 22.4R3 before 22.4R3-S5,\u00a0\\n  *  from 23.2R2 before 23.2R2-S2,\u00a0\\n  *  from 23.4R1 before 23.4R2-S1,\u00a0\\n  *  from 24.2R1 before 24.2R1-S1, 24.2R2.\\n\\n\\nJunos OS Evolved:\\n  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u00a0\\n  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u00a0\\n  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u00a0\\n  *  from 22.4R3-EVO before 22.4R3-S5-EVO,\u00a0\\n  *  from 23.2R2-EVO before 23.2R2-S2-EVO,\u00a0\\n  *  from 23.4R1-EVO before 23.4R2-S1-EVO,\u00a0\\n  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\\n\\n\\nThis issue requires a BGP session to be established.\\n\\nThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\\n\\nThis issue affects iBGP and eBGP.\\n\\nThis issue affects IPv4 and IPv6.\\n\\nAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\\n\\nFor example, by issuing the command on the neighboring device:\\n\u00a0show log messages\\n\\nReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\\n\u00a0 rpd[\u003cpid\u003e]: Received malformed update from \u003cIP address\u003e (External AS \u003cAS#\u003e)\\nand\\n\u00a0 rpd[\u003cpid\u003e]: Malformed Attribute\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de lectura fuera de los l\u00edmites en el daemon de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite que un atacante no autenticado basado en la red env\u00ede paquetes BGP malformados a un dispositivo configurado con opciones de seguimiento de recepci\u00f3n de paquetes habilitadas para bloquear rpd. Este problema afecta a: Junos OS: * desde 21.2R3-S8 antes de 21.2R3-S9, * desde 21.4R3-S7 antes de 21.4R3-S9, * desde 22.2R3-S4 antes de 22.2R3-S5, * desde 22.3R3-S2 antes de 22.3R3-S4, * desde 22.4R3 antes de 22.4R3-S5, * desde 23.2R2 antes de 23.2R2-S2, * desde 23.4R1 antes de 23.4R2-S1, * desde 24.2R1 antes de 24.2R1-S1, 24.2R2. Junos OS Evolved: * desde 21.4R3-S7-EVO hasta 21.4R3-S9-EVO, * desde 22.2R3-S4-EVO hasta 22.2R3-S5-EVO, * desde 22.3R3-S2-EVO hasta 22.3R3-S4-EVO, * desde 22.4R3-EVO hasta 22.4R3-S5-EVO, * desde 23.2R2-EVO hasta 23.2R2-S2-EVO, * desde 23.4R1-EVO hasta 23.4R2-S1-EVO, * desde 24.2R1-EVO hasta 24.2R1-S2-EVO, 24.2R2-EVO. Este problema requiere que se establezca una sesi\u00f3n BGP. Este problema puede propagarse y multiplicarse a trav\u00e9s de varios AS hasta llegar a dispositivos vulnerables. Este problema afecta a iBGP y eBGP. Este problema afecta a IPv4 e IPv6. Un indicador de compromiso puede ser la presencia de mensajes de actualizaci\u00f3n malformados en un AS vecino que no se ve afectado por este problema: por ejemplo, al emitir el comando en el dispositivo vecino: show log messages La revisi\u00f3n de mensajes similares de dispositivos cercanos entre s\u00ed puede indicar que este paquete malformado se est\u00e1 propagando: rpd[]: Se recibi\u00f3 una actualizaci\u00f3n malformada de  (AS externo ) y rpd[]: Atributo malformado\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"AUTOMATIC\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\"}}],\"cvssMetricV31\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"sirt@juniper.net\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://supportportal.juniper.net/JSA92867\",\"source\":\"sirt@juniper.net\"},{\"url\":\"https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html\",\"source\":\"sirt@juniper.net\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21598\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-09T20:14:41.822272Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-09T20:14:50.589Z\"}}], \"cna\": {\"title\": \"Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash\", \"source\": {\"defect\": [\"1821241\"], \"advisory\": \"JSA92867\", \"discovery\": \"USER\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"AUTOMATIC\", \"baseScore\": 8.2, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Juniper Networks\", \"modules\": [\"BGP Traceoptions\", \"BGP\", \"RPD\"], \"product\": \"Junos OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.2R3-S8\", \"lessThan\": \"21.2R3-S9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"21.4R3-S7\", \"lessThan\": \"21.4R3-S9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.2R3-S4\", \"lessThan\": \"22.2R3-S5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3R3-S2\", \"lessThan\": \"22.3R3-S4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4R3\", \"lessThan\": \"22.4R3-S5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2R2\", \"lessThan\": \"23.2R2-S2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.4R1\", \"lessThan\": \"23.4R2-S1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.2R1\", \"lessThan\": \"24.2R1-S1, 24.2R2\", \"versionType\": \"semver\"}], \"packageName\": \"RPD\", \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS Evolved\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.4R3-S7-EVO\", \"lessThan\": \"21.4R3-S9-EVO\", \"versionType\": \"se\"}, {\"status\": \"affected\", \"version\": \"22.2R3-S4-EVO\", \"lessThan\": \"22.2R3-S5-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.3R3-S2-EVO\", \"lessThan\": \"22.3R3-S4-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"22.4R3-EVO\", \"lessThan\": \"22.4R3-S5-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.2R2-EVO\", \"lessThan\": \"23.2R2-S2-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"23.4R1-EVO\", \"lessThan\": \"23.4R2-S1-EVO\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"24.2R1-EVO\", \"lessThan\": \"24.2R1-S2-EVO, 24.2R2-EVO\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following software releases have been updated to resolve this specific issue:\\n\\nJunos OS: 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.\\n\\nJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S1-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue:\u003cbr\u003e\u003cbr\u003eJunos OS: 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.\u003cbr\u003e\u003cbr\u003eJunos OS Evolved: 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S1-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2025-01-08T17:00:00.000Z\", \"references\": [{\"url\": \"https://supportportal.juniper.net/JSA92867\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html\", \"tags\": [\"related\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Disabling packet tracing options will work around this issue.\\n\\nThere are no other available workarounds for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Disabling packet tracing options will work around this issue.\u003cbr\u003e\u003cbr\u003eThere are no other available workarounds for this issue.\u003cbr\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An\\u00a0Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\\u00a0malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\\nThis issue affects:\\n\\nJunos OS:\\u00a0\\n\\n\\n\\n  *  from 21.2R3-S8 before 21.2R3-S9,\\u00a0\\n  *  from 21.4R3-S7 before 21.4R3-S9,\\u00a0\\n  *  from 22.2R3-S4 before 22.2R3-S5,\\u00a0\\n  *  from 22.3R3-S2 before 22.3R3-S4,\\u00a0\\n  *  from 22.4R3 before 22.4R3-S5,\\u00a0\\n  *  from 23.2R2 before 23.2R2-S2,\\u00a0\\n  *  from 23.4R1 before 23.4R2-S1,\\u00a0\\n  *  from 24.2R1 before 24.2R1-S1, 24.2R2.\\n\\n\\nJunos OS Evolved:\\n  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,\\u00a0\\n  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,\\u00a0\\n  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,\\u00a0\\n  *  from 22.4R3-EVO before 22.4R3-S5-EVO,\\u00a0\\n  *  from 23.2R2-EVO before 23.2R2-S2-EVO,\\u00a0\\n  *  from 23.4R1-EVO before 23.4R2-S1-EVO,\\u00a0\\n  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\\n\\n\\nThis issue requires a BGP session to be established.\\n\\nThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\\n\\nThis issue affects iBGP and eBGP.\\n\\nThis issue affects IPv4 and IPv6.\\n\\nAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\\n\\nFor example, by issuing the command on the neighboring device:\\n\\u00a0show log messages\\n\\nReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\\n\\u00a0 rpd[\u003cpid\u003e]: Received malformed update from \u003cIP address\u003e (External AS \u003cAS#\u003e)\\nand\\n\\u00a0 rpd[\u003cpid\u003e]: Malformed Attribute\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: var(--wht);\\\"\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eAn\u0026nbsp;Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u0026nbsp;malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\u003c/span\u003e\u003c/span\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cp\u003eThis issue affects:\u003c/p\u003e\u003cp\u003eJunos OS:\u0026nbsp;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003efrom 21.2R3-S8 before 21.2R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 21.4R3-S7 before 21.4R3-S9,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2R3-S4 before 22.2R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3R3-S2 before 22.3R3-S4,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4R3 before 22.4R3-S5,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2R2 before 23.2R2-S2,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4R1 before 23.4R2-S1,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2R1 before 24.2R1-S1, 24.2R2.\u003c/li\u003e\u003c/ul\u003eJunos OS Evolved:\u003cbr\u003e\u003cul\u003e\u003cli\u003efrom 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 22.4R3-EVO before 22.4R3-S5-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.2R2-EVO before 23.2R2-S2-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 23.4R1-EVO before 23.4R2-S1-EVO,\u0026nbsp;\u003c/li\u003e\u003cli\u003efrom 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\u003c/li\u003e\u003c/ul\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis issue requires a BGP session to be established.\u003cbr\u003e\u003cbr\u003eThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\u003cbr\u003e\u003cbr\u003eThis issue affects iBGP and eBGP.\u003cbr\u003e\u003cbr\u003eThis issue affects IPv4 and IPv6.\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u003cbr\u003eAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\u003cbr\u003e\u003cbr\u003eFor example, by issuing the command on the neighboring device:\u003cbr\u003e\u0026nbsp;show log messages\u003cbr\u003e\u003cbr\u003eReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\u003cbr\u003e\u0026nbsp; rpd[\u0026lt;pid\u0026gt;]: Received malformed update from \u0026lt;IP address\u0026gt; (External AS \u0026lt;AS#\u0026gt;)\u003cbr\u003eand\u003cbr\u003e\u0026nbsp; rpd[\u0026lt;pid\u0026gt;]: Malformed Attribute\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"description\": \"Denial of Service (DoS)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"This issue can occur when bgp trace options are enabled at global, group, or neighbor-level.\\n\\nThe following global example is provided:\\n\\u00a0 [protocols bgp traceoptions flag update detail]\\nor\\n\\u00a0 [protocols bgp traceoptions flag receive detail]\\nand\\n\\u00a0 [protocols bgp traceoptions flag update detail]\\n\\u00a0 [protocols bgp traceoptions flag receive detail]\\n\\nThe following neighbor-level example is provided:\\n\\u00a0 [protocols bgp group test neighbor 192.168.1.1 traceoptions flag update detail]\\n\\u00a0 [protocols bgp group test neighbor 192.168.1.1 traceoptions flag receive detail]\\n\\nRefer to your product documentation for other examples and configurations.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This issue can occur when bgp trace options are enabled at global, group, or neighbor-level.\u003cbr\u003e\u003cbr\u003eThe following global example is provided:\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag update detail]\u003cbr\u003eor\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag receive detail]\u003cbr\u003eand\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag update detail]\u003cbr\u003e\u0026nbsp; [protocols bgp traceoptions flag receive detail]\u003cbr\u003e\u003cbr\u003eThe following neighbor-level example is provided:\u003cbr\u003e\u0026nbsp; [protocols bgp group test neighbor 192.168.1.1 traceoptions flag update detail]\u003cbr\u003e\u0026nbsp; [protocols bgp group test neighbor 192.168.1.1 traceoptions flag receive detail]\u003cbr\u003e\u003cbr\u003eRefer to your product documentation for other examples and configurations.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\", \"dateUpdated\": \"2025-01-09T18:16:32.549Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21598\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-09T20:15:00.238Z\", \"dateReserved\": \"2024-12-26T14:47:11.669Z\", \"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"datePublished\": \"2025-01-09T18:16:32.549Z\", \"assignerShortName\": \"juniper\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2025-21598

Vulnerability from fkie_nvd

Published

2025-01-09 19:15

Modified

2025-01-09 19:15

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

▶	URL	Tags
	sirt@juniper.net	https://supportportal.juniper.net/JSA92867
	sirt@juniper.net	https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An\u00a0Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u00a0malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  from 21.2R3-S8 before 21.2R3-S9,\u00a0\n  *  from 21.4R3-S7 before 21.4R3-S9,\u00a0\n  *  from 22.2R3-S4 before 22.2R3-S5,\u00a0\n  *  from 22.3R3-S2 before 22.3R3-S4,\u00a0\n  *  from 22.4R3 before 22.4R3-S5,\u00a0\n  *  from 23.2R2 before 23.2R2-S2,\u00a0\n  *  from 23.4R1 before 23.4R2-S1,\u00a0\n  *  from 24.2R1 before 24.2R1-S1, 24.2R2.\n\n\nJunos OS Evolved:\n  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4R3-EVO before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2R2-EVO before 23.2R2-S2-EVO,\u00a0\n  *  from 23.4R1-EVO before 23.4R2-S1-EVO,\u00a0\n  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue requires a BGP session to be established.\n\nThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\n\nThis issue affects iBGP and eBGP.\n\nThis issue affects IPv4 and IPv6.\n\nAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\n\nFor example, by issuing the command on the neighboring device:\n\u00a0show log messages\n\nReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\n\u00a0 rpd[\u003cpid\u003e]: Received malformed update from \u003cIP address\u003e (External AS \u003cAS#\u003e)\nand\n\u00a0 rpd[\u003cpid\u003e]: Malformed Attribute"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de lectura fuera de los l\u00edmites en el daemon de protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite que un atacante no autenticado basado en la red env\u00ede paquetes BGP malformados a un dispositivo configurado con opciones de seguimiento de recepci\u00f3n de paquetes habilitadas para bloquear rpd. Este problema afecta a: Junos OS: * desde 21.2R3-S8 antes de 21.2R3-S9, * desde 21.4R3-S7 antes de 21.4R3-S9, * desde 22.2R3-S4 antes de 22.2R3-S5, * desde 22.3R3-S2 antes de 22.3R3-S4, * desde 22.4R3 antes de 22.4R3-S5, * desde 23.2R2 antes de 23.2R2-S2, * desde 23.4R1 antes de 23.4R2-S1, * desde 24.2R1 antes de 24.2R1-S1, 24.2R2. Junos OS Evolved: * desde 21.4R3-S7-EVO hasta 21.4R3-S9-EVO, * desde 22.2R3-S4-EVO hasta 22.2R3-S5-EVO, * desde 22.3R3-S2-EVO hasta 22.3R3-S4-EVO, * desde 22.4R3-EVO hasta 22.4R3-S5-EVO, * desde 23.2R2-EVO hasta 23.2R2-S2-EVO, * desde 23.4R1-EVO hasta 23.4R2-S1-EVO, * desde 24.2R1-EVO hasta 24.2R1-S2-EVO, 24.2R2-EVO. Este problema requiere que se establezca una sesi\u00f3n BGP. Este problema puede propagarse y multiplicarse a trav\u00e9s de varios AS hasta llegar a dispositivos vulnerables. Este problema afecta a iBGP y eBGP. Este problema afecta a IPv4 e IPv6. Un indicador de compromiso puede ser la presencia de mensajes de actualizaci\u00f3n malformados en un AS vecino que no se ve afectado por este problema: por ejemplo, al emitir el comando en el dispositivo vecino: show log messages La revisi\u00f3n de mensajes similares de dispositivos cercanos entre s\u00ed puede indicar que este paquete malformado se est\u00e1 propagando: rpd[]: Se recibi\u00f3 una actualizaci\u00f3n malformada de  (AS externo ) y rpd[]: Atributo malformado"
    }
  ],
  "id": "CVE-2025-21598",
  "lastModified": "2025-01-09T19:15:20.123",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "sirt@juniper.net",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "AUTOMATIC",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-09T19:15:20.123",
  "references": [
    {
      "source": "sirt@juniper.net",
      "url": "https://supportportal.juniper.net/JSA92867"
    },
    {
      "source": "sirt@juniper.net",
      "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "sirt@juniper.net",
      "type": "Primary"
    }
  ]
}

ncsc-2025-0006

Vulnerability from csaf_ncscnl

Published

2025-01-10 12:14

Modified

2025-01-10 12:14

Summary

Kwetsbaarheden verholpen in Juniper JunOS

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Juniper heeft kwetsbaarheden verholpen in JunS (Specifiek voor JunOS en JunOS Evolved).

Interpretaties

De kwetsbaarheden bevinden zich in de manier waarop Juniper's JunOS en JunOS Evolved omgaan met BGP-pakketten en IPv6-pakketten. De eerste kwetsbaarheid kan worden misbruikt door ongeauthenticeerde aanvallers die vervormde BGP-pakketten verzenden, wat kan leiden tot een crash van de routing protocol daemon (rpd). Dit vereist een gevestigde BGP-sessie, wat het een significante zorg maakt voor de netwerkstabiliteit. De tweede kwetsbaarheid in de Juniper Tunnel Driver laat ongeauthenticeerde aanvallers toe om vervormde IPv6-pakketten te verzenden, wat kan resulteren in geheugenuitputting en daaropvolgende systeemcrashes, met impact op de stabiliteit van de getroffen systemen.

Oplossingen

Juniper heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-401

Missing Release of Memory after Effective Lifetime

CWE-125

Out-of-bounds Read

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Juniper heeft kwetsbaarheden verholpen in JunS (Specifiek voor JunOS en JunOS Evolved).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in de manier waarop Juniper\u0027s JunOS en JunOS Evolved omgaan met BGP-pakketten en IPv6-pakketten. De eerste kwetsbaarheid kan worden misbruikt door ongeauthenticeerde aanvallers die vervormde BGP-pakketten verzenden, wat kan leiden tot een crash van de routing protocol daemon (rpd). Dit vereist een gevestigde BGP-sessie, wat het een significante zorg maakt voor de netwerkstabiliteit. De tweede kwetsbaarheid in de Juniper Tunnel Driver laat ongeauthenticeerde aanvallers toe om vervormde IPv6-pakketten te verzenden, wat kan resulteren in geheugenuitputting en daaropvolgende systeemcrashes, met impact op de stabiliteit van de getroffen systemen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Juniper heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Missing Release of Memory after Effective Lifetime",
        "title": "CWE-401"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd",
        "url": "https://supportportal.juniper.net/JSA92867"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd",
        "url": "https://supportportal.juniper.net/JSA92869"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Juniper JunOS",
    "tracking": {
      "current_release_date": "2025-01-10T12:14:00.841636Z",
      "id": "NCSC-2025-0006",
      "initial_release_date": "2025-01-10T12:14:00.841636Z",
      "revision_history": [
        {
          "date": "2025-01-10T12:14:00.841636Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "junos_os",
            "product": {
              "name": "junos_os",
              "product_id": "CSAFPID-1709686",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "junos_os_evolved",
            "product": {
              "name": "junos_os_evolved",
              "product_id": "CSAFPID-1718382",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:juniper_networks:junos_os_evolved:*:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "juniper_networks"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "junos",
            "product": {
              "name": "junos",
              "product_id": "CSAFPID-261205",
              "product_identification_helper": {
                "cpe": "cpe:2.3:o:juniper:junos:-:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "junos",
            "product": {
              "name": "junos",
              "product_id": "CSAFPID-1636524",
              "product_identification_helper": {
                "cpe": "cpe:2.3:o:juniper:junos:evolved:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21598",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-261205",
          "CSAFPID-1636524",
          "CSAFPID-1709686",
          "CSAFPID-1718382"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-21598",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21598.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-261205",
            "CSAFPID-1636524",
            "CSAFPID-1709686",
            "CSAFPID-1718382"
          ]
        }
      ],
      "title": "CVE-2025-21598"
    },
    {
      "cve": "CVE-2025-21599",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Release of Memory after Effective Lifetime",
          "title": "CWE-401"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-261205",
          "CSAFPID-1636524",
          "CSAFPID-1718382"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-21599",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21599.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-261205",
            "CSAFPID-1636524",
            "CSAFPID-1718382"
          ]
        }
      ],
      "title": "CVE-2025-21599"
    }
  ]
}

ghsa-68jp-4r95-v8vr

Vulnerability from github

Published

2025-01-09 21:31

Modified

2025-01-09 21:31

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber

Details

Junos OS:

from 21.2R3-S8 before 21.2R3-S9,
from 21.4R3-S7 before 21.4R3-S9,
from 22.2R3-S4 before 22.2R3-S5,
from 22.3R3-S2 before 22.3R3-S4,
from 22.4R3 before 22.4R3-S5,
from 23.2R2 before 23.2R2-S2,
from 23.4R1 before 23.4R2-S1,
from 24.2R1 before 24.2R1-S1, 24.2R2.

Junos OS Evolved: * from 21.4R3-S7-EVO before 21.4R3-S9-EVO, * from 22.2R3-S4-EVO before 22.2R3-S5-EVO, * from 22.3R3-S2-EVO before 22.3R3-S4-EVO, * from 22.4R3-EVO before 22.4R3-S5-EVO, * from 23.2R2-EVO before 23.2R2-S2-EVO, * from 23.4R1-EVO before 23.4R2-S1-EVO, * from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.

This issue requires a BGP session to be established.

This issue can propagate and multiply through multiple ASes until reaching vulnerable devices.

This issue affects iBGP and eBGP.

This issue affects IPv4 and IPv6.

An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:

For example, by issuing the command on the neighboring device: show log messages

Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating: rpd[]: Received malformed update from (External AS ) and rpd[]: Malformed Attribute

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-21598"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-09T19:15:20Z",
    "severity": "HIGH"
  },
  "details": "An\u00a0Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved\u0027s routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send\u00a0malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n  *  from 21.2R3-S8 before 21.2R3-S9,\u00a0\n  *  from 21.4R3-S7 before 21.4R3-S9,\u00a0\n  *  from 22.2R3-S4 before 22.2R3-S5,\u00a0\n  *  from 22.3R3-S2 before 22.3R3-S4,\u00a0\n  *  from 22.4R3 before 22.4R3-S5,\u00a0\n  *  from 23.2R2 before 23.2R2-S2,\u00a0\n  *  from 23.4R1 before 23.4R2-S1,\u00a0\n  *  from 24.2R1 before 24.2R1-S1, 24.2R2.\n\n\nJunos OS Evolved:\n  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,\u00a0\n  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,\u00a0\n  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,\u00a0\n  *  from 22.4R3-EVO before 22.4R3-S5-EVO,\u00a0\n  *  from 23.2R2-EVO before 23.2R2-S2-EVO,\u00a0\n  *  from 23.4R1-EVO before 23.4R2-S1-EVO,\u00a0\n  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue requires a BGP session to be established.\n\nThis issue can propagate and multiply through multiple ASes until reaching vulnerable devices.\n\nThis issue affects iBGP and eBGP.\n\nThis issue affects IPv4 and IPv6.\n\nAn indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:\n\nFor example, by issuing the command on the neighboring device:\n\u00a0show log messages\n\nReviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:\n\u00a0 rpd[\u003cpid\u003e]: Received malformed update from \u003cIP address\u003e (External AS \u003cAS#\u003e)\nand\n\u00a0 rpd[\u003cpid\u003e]: Malformed Attribute",
  "id": "GHSA-68jp-4r95-v8vr",
  "modified": "2025-01-09T21:31:30Z",
  "published": "2025-01-09T21:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21598"
    },
    {
      "type": "WEB",
      "url": "https://supportportal.juniper.net/JSA92867"
    },
    {
      "type": "WEB",
      "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

wid-sec-w-2025-0031

Vulnerability from csaf_certbund

Published

2025-01-08 23:00

Modified

2025-01-08 23:00

Summary

Juniper JUNOS: Mehrere Schwachstellen ermöglichen Denial of Service und Informationsoffenlegung

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.

Angriff

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service Angriff durchzuführen und um vertrauliche Informationen preiszugeben.

Betroffene Betriebssysteme

- Sonstiges - UNIX

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JUNOS ist das \"Juniper Network Operating System\", das in Juniper Appliances verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren und um vertrauliche Informationen preiszugeben.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0031 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0031.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0031 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0031"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specially-crafted-BGP-update-packet-causes-RPD-crash-CVE-2025-21602"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-traceoptions-are-configured-receipt-of-malformed-BGP-packets-causes-RPD-to-crash-CVE-2025-21598"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-certain-BGP-options-enabled-receipt-of-specifically-malformed-BGP-update-causes-RPD-crash-CVE-2025-21600"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-Evolved-Receipt-of-specifically-malformed-IPv6-packets-causes-kernel-memory-exhaustion-leading-to-Denial-of-Service-CVE-2025-21599"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX1500-SRX4100-SRX4200-Execution-of-low-privileged-CLI-command-results-in-chassisd-crash-CVE-2025-21596"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin vom 2025-01-08",
        "url": "https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592"
      }
    ],
    "source_lang": "en-US",
    "title": "Juniper JUNOS: Mehrere Schwachstellen erm\u00f6glichen Denial of Service und Informationsoffenlegung",
    "tracking": {
      "current_release_date": "2025-01-08T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-09T10:12:20.038+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2025-0031",
      "initial_release_date": "2025-01-08T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-01-08T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Juniper JUNOS",
                "product": {
                  "name": "Juniper JUNOS",
                  "product_id": "T040098",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Evolved",
                "product": {
                  "name": "Juniper JUNOS Evolved",
                  "product_id": "T040099",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:evolved"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JUNOS"
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21593",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21593"
    },
    {
      "cve": "CVE-2025-21600",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21600"
    },
    {
      "cve": "CVE-2025-21602",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS bestehen mehrere Schwachstellen, die den Routing Protocol Daemon (rpd) betreffen. Diese Schwachstellen bestehen aufgrund einer unsachgem\u00e4\u00dfen Verwaltung von Ressourcen w\u00e4hrend ihres Lebenszyklus, einer unsachgem\u00e4\u00dfen Behandlung bestimmter Ausnahmebedingungen bei der Verarbeitung bestimmter BGP-Aktualisierungspakete und einer unsachgem\u00e4\u00dfen Verarbeitung spezifisch missgebildeter BGP-Pakete von einem logisch benachbarten BGP-Peer. Ein Angreifer aus einem benachbarten Netzwerk kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21602"
    },
    {
      "cve": "CVE-2025-21598",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Juniper JUNOS. Diese Schwachstellen bestehen, weil der Juniper-Tunneltreiber (jtd) den Kernel-Speicher nicht ordnungsgem\u00e4\u00df freigibt, nachdem er nicht mehr ben\u00f6tigt wird, und weil der Routing-Protokoll-D\u00e4mon (rpd) nicht ordnungsgem\u00e4\u00df mit fehlerhaften BGP-Paketen umgeht, wenn die Paketempfangs-Trace-Optionen aktiviert sind, was zu einem Systemabsturz f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen \u0027Denial of Service\u0027-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21598"
    },
    {
      "cve": "CVE-2025-21599",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Juniper JUNOS. Diese Schwachstellen bestehen, weil der Juniper-Tunneltreiber (jtd) den Kernel-Speicher nicht ordnungsgem\u00e4\u00df freigibt, nachdem er nicht mehr ben\u00f6tigt wird, und weil der Routing-Protokoll-D\u00e4mon (rpd) nicht ordnungsgem\u00e4\u00df mit fehlerhaften BGP-Paketen umgeht, wenn die Paketempfangs-Trace-Optionen aktiviert sind, was zu einem Systemabsturz f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen \u0027Denial of Service\u0027-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21599"
    },
    {
      "cve": "CVE-2025-21596",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Juniper JUNOS. Diese Schwachstelle wird durch die unsachgem\u00e4\u00dfe Behandlung von Ausnahmebedingungen in der Befehlszeilenverarbeitung des Befehls show chassis environment pem auf betroffenen Juniper Networks SRX-Ger\u00e4ten verursacht. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21596"
    },
    {
      "cve": "CVE-2025-21592",
      "notes": [
        {
          "category": "description",
          "text": "In Juniper JUNOS besteht eine Schwachstelle, die auf unzureichende Zugriffskontrollen in der Befehlszeilenschnittstelle zur\u00fcckzuf\u00fchren ist. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen preiszugeben."
        }
      ],
      "product_status": {
        "known_affected": [
          "T040098",
          "T040099"
        ]
      },
      "release_date": "2025-01-08T23:00:00.000+00:00",
      "title": "CVE-2025-21592"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-21598 (GCVE-0-2025-21598)

Vulnerability from cvelistv5

fkie_cve-2025-21598

Vulnerability from fkie_nvd

ncsc-2025-0006

Vulnerability from csaf_ncscnl

ghsa-68jp-4r95-v8vr

Vulnerability from github

wid-sec-w-2025-0031

Vulnerability from csaf_certbund

Tags

Sightings

Nomenclature