CVE-2019-16020 — Uncontrolled Resource Consumption in Cisco IOS XR Software

CWE-399CWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
8.6HIGHNVD
EPSS
2.5%
top 14.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XR SoftwareCisco IOS XR
Timeline
PublishedJan 26
Latest updateMay 24

Description

Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to incorrect processing of BGP update messages that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update messages with malformed attributes to be processed by an affected system. A suc…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages2 packages

▶CVEListV5cisco/cisco_ios_xr_softwareunspecified — n/a
▶NVDcisco/ios_xr4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-wfx4-9gjq-7h6w: Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow↗2022-05-24
▶
CVEList
Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities↗2020-01-26
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities↗2020-01-22
▶

💬Community

1
Bugzilla
CVE-2019-16319 wireshark: gryphon dissector infinite loop (wnpa-sec-2019-21)↗2019-11-21
▶
CVE-2019-16020 — Uncontrolled Resource Consumption | cvebase