CVE-2021-31353

Junos OS and Junos OS Evolved: RPD core upon receipt of specific BGP update

State
Published
Severity
7.5 High
Published
Oct 19, 2021
Updated
Sep 16, 2024
Reserved
Apr 15, 2021

Read the record on cve.org

Description

An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an attacker to inject a specific BGP update, causing the routing protocol daemon (RPD) to crash and restart, leading to a Denial of Service (DoS). Continued receipt and processing of the BGP update will create a sustained Denial of Service (DoS) condition. This issue affects very specific versions of Juniper Networks Junos OS: 19.3R3-S2; 19.4R3-S3; 20.2 versions 20.2R2-S3 and later, prior to 20.2R3-S2; 20.3 versions 20.3R2 and later, prior to 20.3R3; 20.4 versions 20.4R2 and later, prior to 20.4R3; 21.1 versions prior to 21.1R2. Juniper Networks Junos OS 20.1 is not affected by this issue. This issue also affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO, 20.4R3-EVO; 21.1-EVO versions prior to 21.1R2-EVO; 21.2-EVO versions prior to 21.2R2-EVO.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hjuniper

Weaknesses

  • CWE-755 Improper Handling of Exceptional Conditions

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 19.3R3-S2Not affected
  • 19.3R3-S2Affected
  • 19.4R3-S3Affected
  • 20.1R1 to before 20.1*Not affected
  • 20.2 to before 20.2R2-S3Not affectedfrom 20.2R3-S2Not affected
  • 20.3 to before 20.3R2Not affectedfrom 20.3R3Not affected
  • 20.4 to before 20.4R2Not affectedfrom 20.4R3Not affected
  • 21.1 to before 21.1R2Affected
Junos OS EvolvedJuniper Networks
  • before 20.4R2-S3-EVO, 20.4R3-EVOAffected
  • 21.1-EVO to before 21.1R2-EVOAffected
  • 21.2-EVO to before 21.2R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.