CVE-2022-22219 — Improper Handling of Unexpected Data Type in Networks Junos OS

CWE-241 — Improper Handling of Unexpected Data Type4 documents4 sources
Severity
5.9MEDIUMNVD
EPSS
0.5%
top 34.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper Networks Junos OS EvolvedJuniper Junos+1 more
Timeline
PublishedOct 18

Description

Due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved, an attacker in direct control of a BGP client connected to a route reflector, or via a machine in the middle (MITM) attack, can send a specific EVPN route contained within a BGP Update, triggering a routing protocol daemon (RPD) crash, leading to a Denial of Service (DoS) condition. Continued receipt and processing of these specific EVPN routes could create …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolved21.3R1-EVO — 21.3*+3
▶CVEListV5juniper_networks/junos_os21.3 — 21.3R3-S2+3
▶NVDjuniper/junos_os_evolved21.3, 22.1, 22.2+2
▶NVDjuniper/junos4 versions+3

🔴Vulnerability Details

2
CVEList
Junos OS and Junos OS Evolved: RPD core upon receipt of a specific EVPN route by a BGP route reflector in an EVPN environment↗2022-10-18
▶
GHSA
GHSA-34pj-rwf2-r7x2: Due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved, an attacke↗2022-10-18
▶

📋Vendor Advisories

1
Juniper
CVE-2022-22219: Due to the Improper Handling of an Unexpected Data Type in the processing of EVPN routes on Juniper Networks Junos OS and Junos OS Evolved, an attacke↗2022-10-18
▶
CVE-2022-22219 — Networks Junos OS vulnerability | cvebase