CVE-2021-0250

Junos OS and Junos OS Evolved: An attacker sending a specific crafted BGP update message will crash RPD

State
Published
Severity
7.5 High
Published
Apr 22, 2021
Updated
Sep 17, 2024
Reserved
Oct 27, 2020

Read the record on cve.org

Description

In segment routing traffic engineering (SRTE) environments where the BGP Monitoring Protocol (BMP) feature is enable, a vulnerability in the Routing Protocol Daemon (RPD) process of Juniper Networks Junos OS allows an attacker to send a specific crafted BGP update message causing the RPD service to core, creating a Denial of Service (DoS) Condition. Continued receipt and processing of this update message will create a sustained Denial of Service (DoS) condition. This issue affects IPv4 and IPv6 environments. This issue affects: Juniper Networks Junos OS 17.4 versions 17.4R1 and above prior to 17.4R2-S6, 17.4R3; 18.1 versions prior to 18.1R3-S7; 18.2 versions prior to 18.2R2-S6, 18.2R3-S3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S3, 19.2R2, This issue does not affect Junos OS releases prior to 17.4R1. This issue affects: Juniper Networks Junos OS Evolved 19.2-EVO versions prior to 19.2R2-EVO.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Junos OSJuniper Networks
  • 17.4R1 to before unspecifiedAffected
  • 17.4 to before 17.4R2-S6, 17.4R3Affected
  • 18.1 to before 18.1R3-S7Affected
  • 18.2 to before 18.2R2-S6, 18.2R3-S3Affected
  • 18.3 to before 18.3R1-S7, 18.3R2-S3, 18.3R3Affected
  • 18.4 to before 18.4R1-S5, 18.4R2-S3, 18.4R3Affected
  • 19.1 to before 19.1R1-S4, 19.1R2Affected
  • 19.2 to before 19.2R1-S3, 19.2R2Affected
Junos OS EvolvedJuniper Networks
  • 19.2-EVO to before 19.2R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.