CVE-2023-22398CWE-824

Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs

Medium · published January 12, 2023

CVSS v3.1
5.3
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

An Access of Uninitialized Pointer vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS). When an MPLS ping is performed on BGP LSPs, the RPD might crash. Repeated execution of this operation will lead to a sustained DoS. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S12; 19.1 versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R1-S1, 21.1R2; Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R2-EVO.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2023-01-12T00:00Z
EPSS history
Timeline
  • 12 JAN 00:00Z
    Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs
    cvelistv5