CVE-2021-0228
published 2021-04-22CVE-2021-0228: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator)…
medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator) deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, may allow an attacker sending specific Layer 2 traffic to cause Distributed Denial of Service (DDoS) protection to trigger unexpectedly, resulting in traffic impact. Continued receipt and processing of this specific Layer 2 frames will sustain the Denial of Service (DoS) condition. An indication of compromise is to check DDOS LACP violations: user@device> show ddos-protection protocols statistics brief | match lacp This issue only affects the MX Series platforms with Trio-based MPC. No other products or platforms are affected. This issue affects: Juniper Networks Junos OS on MX Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S8; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2, 20.1R3; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2;
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | mx_series | — | — |
| juniper_networks | junos_os | >= 15.1 < 15.1R7-S9 | 15.1R7-S9 |
| juniper_networks | junos_os | >= 17.3 < 17.3R3-S11 | 17.3R3-S11 |
| juniper_networks | junos_os | >= 17.4 < 17.4R3-S4 | 17.4R3-S4 |
| juniper_networks | junos_os | >= 18.1 < 18.1R3-S12 | 18.1R3-S12 |
| juniper_networks | junos_os | >= 18.2 < 18.2R2-S8, 18.2R3-S8 | 18.2R2-S8, 18.2R3-S8 |
| juniper_networks | junos_os | >= 18.3 < 18.3R3-S4 | 18.3R3-S4 |
| juniper_networks | junos_os | >= 18.4 < 18.4R1-S8, 18.4R2-S7, 18.4R3-S7 | 18.4R1-S8, 18.4R2-S7, 18.4R3-S7 |
| juniper_networks | junos_os | >= 19.1 < 19.1R3-S4 | 19.1R3-S4 |
| juniper_networks | junos_os | >= 19.2 < 19.2R1-S6 | 19.2R1-S6 |
GHSA
GHSA-389v-3v24-gh3w: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concen
ghsa_unreviewed·2022-05-24
CVE-2021-0228 [MEDIUM] CWE-754 GHSA-389v-3v24-gh3w: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concen
An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator) deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, may allow an attacker sending specific Layer 2 traffic to cause Distributed Denial of Service (DDoS) protection to trigger unexpectedly, resulting in traffic impact. Continued receipt and processing of this specific Layer 2 frames will sustain the Denial of Service (DoS) condition. An indication of compromise is to check DDOS LACP violations: user@device> show ddos-protection protocols statistics brief | match lacp This issue only affects the MX Series platforms with Trio-based MPC. No other products or platforms are affected. This issue affects: Juniper Net
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Onboarding (Apache PDFbox) — CVE-2019-0228
vendor_oracle·2021-07-15·CVSS 9.8
CVE-2019-0228 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Onboarding (Apache PDFbox) — CVE-2019-0228
Oracle Oracle Financial Services Applications Risk Matrix: Onboarding (Apache PDFbox) vulnerability
CVE: CVE-2019-0228
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Juniper
CVE-2021-0228: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concen
vendor_juniper·2021-04-22·CVSS 6.5
CVE-2021-0228 [MEDIUM] CWE-754 CVE-2021-0228: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concen
CVE-2021-0228: An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator) deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, may allow an attacker sending specific Layer 2 traffic to cause Distributed Denial of Service (DDoS) protection to trigger unexpectedly, resulting in traffic impact. Continued receipt and processing of this specific Layer 2 frames will sustain the Denial of Service (DoS) condition. An indication of compromise is to check DDOS LACP violations: user@device> show ddos-protection protocols statistics brief | match lacp This issue only affects the MX Series platforms with Trio-based MPC. No other products or platforms are affected. This issue affec
Oracle
Oracle Oracle Communications Applications Risk Matrix: Message Store (Apache PDFBox) — CVE-2019-0228
vendor_oracle·2021-04-15·CVSS 9.8
CVE-2019-0228 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Message Store (Apache PDFBox) — CVE-2019-0228
Oracle Oracle Communications Applications Risk Matrix: Message Store (Apache PDFBox) vulnerability
CVE: CVE-2019-0228
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-04-22
Published