CVE-2019-0019

BGP packets can trigger rpd crash when BGP tracing is enabled.

State: Published
Severity: 7.5 High
Published: Apr 10, 2019
Updated: Sep 16, 2024
Reserved: Oct 11, 2018

Description

When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9, 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3, 17.3R3-S4, 17.3R4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4, 18.1R4; 18.2 versions prior to 18.2R2-S2, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. This issue does not affect Junos releases prior to 16.1R1.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	juniper

Weaknesses

CWE-404 Improper Resource Shutdown or Release

Affected Products

Product	Versions
Junos OSJuniper Networks	16.1 to before 16.1R7-S4, 16.1R7-S5Affected 16.2 to before 16.2R2-S9, 16.2R3Affected 17.1 to before 17.1R3Affected 17.2 to before 17.2R3-S1Affected 17.3 to before 17.3R3-S3, 17.3R3-S4, 17.3R4Affected 17.4 to before 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3Affected 18.1 to before 18.1R2-S4, 18.1R3-S4, 18.1R4Affected 18.2 to before 18.2R2-S2, 18.2R2-S3, 18.2R3Affected 18.2X75 to before 18.2X75-D40Affected 18.3 to before 18.3R1-S3, 18.3R2Affected 18.4 to before 18.4R1-S2, 18.4R2Affected all to before 16.1Not affected

Product

Versions

Junos OSJuniper Networks

16.1 to before 16.1R7-S4, 16.1R7-S5Affected
16.2 to before 16.2R2-S9, 16.2R3Affected
17.1 to before 17.1R3Affected
17.2 to before 17.2R3-S1Affected
17.3 to before 17.3R3-S3, 17.3R3-S4, 17.3R4Affected
17.4 to before 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3Affected
18.1 to before 18.1R2-S4, 18.1R3-S4, 18.1R4Affected
18.2 to before 18.2R2-S2, 18.2R2-S3, 18.2R3Affected
18.2X75 to before 18.2X75-D40Affected
18.3 to before 18.3R1-S3, 18.3R2Affected
18.4 to before 18.4R1-S2, 18.4R2Affected
all to before 16.1Not affected

References

https://kb.juniper.net/JSA10931
107893vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.