CVE-2019-0073

Junos OS: PKI key pairs are exported with insecure file permissions

State: Published
Severity: 6.6 Medium
Published: Oct 9, 2019
Updated: Sep 16, 2024
Reserved: Oct 11, 2018

Description

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	juniper

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
Junos OSJuniper Networks	15.1X49 to before 15.1X49-D180Affected 17.3 to before 17.3R3-S7Affected 17.4 to before 17.4R2-S8, 17.4R3Affected 18.1 to before 18.1R3-S8Affected 18.2 to before 18.2R3Affected 18.3 to before 18.3R2Affected 18.4 to before 18.4R2Affected

References

https://kb.juniper.net/JSA10974

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.