CVE-2024-39541

Junos OS and Junos OS Evolved: Inconsistent information in the TE database can lead to an rpd crash

State: Published
Severity: 7.1 High
Published: Jul 11, 2024
Updated: Aug 2, 2024
Reserved: Jun 25, 2024

Description

An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

When conflicting information (IP or ISO addresses) about a node is added to the Traffic Engineering (TE) database and then a subsequent operation attempts to process these, rpd will crash and restart.

This issue affects:

Junos OS:

* 22.4 versions before 22.4R3-S1, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R1-S1, 23.4R2,

This issue does not affect Junos OS versions earlier than 22.4R1.

Junos OS Evolved:

* 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R1-S1-EVO, 23.4R2-EVO,

This issue does not affect Junos OS Evolved versions earlier than

before 22.4R1.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L	juniper
3.1	6.5 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	juniper

Weaknesses

CWE-755 Improper Handling of Exceptional Conditions

Affected Products

Product	Versions
Junos OSJuniper Networks	22.4 to before 22.4R3-S1Affected 23.2 to before 23.2R2Affected 23.4 to before 23.4R1-S1, 23.4R2Affected before 22.4R1Not affected
Junos OS EvolvedJuniper Networks	22.4-EVO to before 22.4R3-S2-EVOAffected 23.2-EVO to before 23.2R2-EVOAffected 23.4-EVO to before 23.4R1-S1-EVO, 23.4R2-EVOAffected before 22.4R1Not affected

References

https://supportportal.juniper.net/JSA83001vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.