CVE-2019-0049

Junos OS: RPD process crashes when BGP peer restarts

State: Published
Severity: 7.5 High
Published: Jul 11, 2019
Updated: Sep 16, 2024
Reserved: Oct 11, 2018

Description

On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. Repeated crashes of the RPD process can cause prolonged Denial of Service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S3; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.2X75 versions prior to 17.2X75-D105; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S7, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D12, 18.2X75-D30; 18.3 versions prior to 18.3R1-S4, 18.3R2. Junos OS releases prior to 16.1R1 are not affected.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	juniper

Weaknesses

CWE-404 Improper Resource Shutdown or Release

Affected Products

Product	Versions
Junos OSJuniper Networks	16.1 versions prior to 16.1R7-S3Affected 16.2 versions prior to 16.2R2-S9Affected 17.1 versions prior to 17.1R3Affected 17.2 versions prior to 17.2R3Affected 17.2X75 versions prior to 17.2X75-D105Affected 17.3 versions prior to 17.3R3-S2Affected 17.4 versions prior to 17.4R1-S7 to 17.4R2-S2 and to 17.4R3Affected 18.1 versions prior to 18.1R3-S2Affected 18.2 versions prior to 18.2R2Affected 18.2X75 versions prior to 18.2X75-D12 and 18.2X75-D30Affected 18.3 versions prior to 18.3R1-S4 and 18.3R2Affected

Product

Versions

Junos OSJuniper Networks

16.1 versions prior to 16.1R7-S3Affected
16.2 versions prior to 16.2R2-S9Affected
17.1 versions prior to 17.1R3Affected
17.2 versions prior to 17.2R3Affected
17.2X75 versions prior to 17.2X75-D105Affected
17.3 versions prior to 17.3R3-S2Affected
17.4 versions prior to 17.4R1-S7 to 17.4R2-S2 and to 17.4R3Affected
18.1 versions prior to 18.1R3-S2Affected
18.2 versions prior to 18.2R2Affected
18.2X75 versions prior to 18.2X75-D12 and 18.2X75-D30Affected
18.3 versions prior to 18.3R1-S4 and 18.3R2Affected

References

https://kb.juniper.net/JSA10943

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.