CVE-2021-28505
Assigner: Arista
Published: 2022-03-29T00:00:00
State: PUBLISHED
affected: product: EOS
vendor: Arista Networks
versions: lessThanOrEqual: 4.26.0
status: affected
version: 4.26.3M
versionType: custom
lessThanOrEqual: 4.27.0
status: affected
version: 4.27.0F
versionType: custom
datePublic: 2022-03-29T00:00:00
descriptions: value: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
solutions: value: The recommended resolution is to upgrade to a remediated software version at your earliest convenience.
Artista recommends customers move to the latest version of each release that contains all the fixes listed below.

CVE-2021-28505 has been fixed in the following releases:

4.26.4M and later releases in the 4.26.x train
4.27.1F and later releases in the 4.27.x train
source: advisory: 73
defect: BUG
609752
discovery: INTERNAL
title: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.
workarounds: value: Replace "vxlan" IP protocol match with match on IP protocol "udp" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. < br/> If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number.
x_generator: engine: Vulnogram 0.0.9