CVE-2022-22163

published 2022-01-19

CVE-2022-22163: An Improper Input Validation vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to…

medium 6.5 CVSS 3.1

AV A AC L PR N UI N S U C N I N A H

An Improper Input Validation vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a crash of jdhcpd and thereby a Denial of Service (DoS). If a device is configured as DHCPv6 local server and persistent storage is enabled, jdhcpd will crash when receiving a specific DHCPv6 message. This issue affects: Juniper Networks Junos OS All versions prior to 15.1R7-S11; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R2.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	< 15.1	15.1
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper_networks	junos_os	>= 18.4 < 18.4R3-S9	18.4R3-S9
juniper_networks	junos_os	>= 19.1 < 19.1R2-S3, 19.1R3-S7	19.1R2-S3, 19.1R3-S7
juniper_networks	junos_os	>= 19.2 < 19.2R1-S8, 19.2R3-S3	19.2R1-S8, 19.2R3-S3
juniper_networks	junos_os	>= 19.4 < 19.4R3-S5	19.4R3-S5
juniper_networks	junos_os	>= 20.1 < 20.1R3-S1	20.1R3-S1
juniper_networks	junos_os	>= 20.2 < 20.2R3-S2	20.2R3-S2
juniper_networks	junos_os	>= 20.3 < 20.3R3-S1	20.3R3-S1
juniper_networks	junos_os	>= 20.4 < 20.4R3	20.4R3
juniper_networks	junos_os	>= 21.1 < 21.1R2	21.1R2
juniper_networks	junos_os	>= 21.2 < 21.2R2	21.2R2
juniper_networks	junos_os	>= unspecified < 15.1R7-S11	15.1R7-S11

CWE-20