CVE-2022-22218
Assigner: juniper
Published: 2022-10-12T00:00:00
State: PUBLISHED
title: Junos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollment
datePublic: 2022-10-12T00:00:00
descriptions: value: On SRX Series devices, an Improper Check for Unusual or Exceptional Conditions when using Certificate Management Protocol Version 2 (CMPv2) auto re-enrollment, allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS) by crashing the pkid process. The pkid process cannot handle an unexpected response from the Certificate Authority (CA) server, leading to crash. A restart is required to restore services. This issue affects: Juniper Networks Junos OS on SRX Series: All versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R3-S9; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S4; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R2.
affected: vendor: Juniper Networks
product: Junos OS
versions: version: unspecified
lessThan: 19.1R3-S9
status: affected
versionType: custom
version: 19.2
status: affected
lessThan: 19.2R3-S6
versionType: custom
version: 19.3
status: affected
lessThan: 19.3R3-S7
versionType: custom
version: 19.4
status: affected
lessThan: 19.4R3-S9
versionType: custom
version: 20.2
status: affected
lessThan: 20.2R3-S5
versionType: custom
version: 20.3
status: affected
lessThan: 20.3R3-S4
versionType: custom
version: 20.4
status: affected
lessThan: 20.4R3-S4
versionType: custom
version: 21.1
status: affected
lessThan: 21.1R3-S1
versionType: custom
version: 21.2
status: affected
lessThan: 21.2R3
versionType: custom
version: 21.3
status: affected
lessThan: 21.3R2
versionType: custom
version: 21.4
status: affected
lessThan: 21.4R2
versionType: custom
platforms: SRX Series
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: text
description: Denial of Service (DoS)
descriptions: type: CWE
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
cweId: CWE-754
x_generator: engine: Vulnogram 0.0.9
source: advisory: JSA69901
defect: 1642410
discovery: USER
configurations: value: The following minimal configuration must be present to be potentially vulnerable to this issue:
  [security pki auto-re-enrollment cmpv2]
workarounds: value: There are no known workarounds for this issue.
exploits: value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: value: The following software releases have been updated to resolve this specific issue:

Junos OS: 19.1R3-S9, 19.2R3-S6, 19.3R3-S7, 19.4R2-S7, 19.4R3-S9, 20.2R3-S5, 20.3R3-S4, 20.4R3-S4, 21.1R3-S1, 21.2R3, 21.3R2, 21.4R1-S2, 21.4R2, 22.1R1, and all subsequent releases.