CVE-2023-22417
Assigner: juniper
Published: 2023-01-12T00:00:00
State: PUBLISHED
title: Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash
datePublic: 2023-01-11T00:00:00
descriptions: value: A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is configured. Eventually the flowd process will crash and restart. This issue affects Juniper Networks Junos OS on SRX Series: All versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S8, 19.4R3-S10; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2.
affected: vendor: Juniper Networks
product: Junos OS
versions: version: unspecified
lessThan: 19.3R3-S7
status: affected
versionType: custom
version: 19.4
status: affected
lessThan: 19.4R2-S8, 19.4R3-S10
versionType: custom
version: 20.2
status: affected
lessThan: 20.2R3-S6
versionType: custom
version: 20.3
status: affected
lessThan: 20.3R3-S5
versionType: custom
version: 20.4
status: affected
lessThan: 20.4R3-S5
versionType: custom
version: 21.1
status: affected
lessThan: 21.1R3-S4
versionType: custom
version: 21.2
status: affected
lessThan: 21.2R3
versionType: custom
version: 21.3
status: affected
lessThan: 21.3R3
versionType: custom
version: 21.4
status: affected
lessThan: 21.4R2
versionType: custom
platforms: SRX Series
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-401 Missing Release of Memory after Effective Lifetime
cweId: CWE-401
descriptions: type: text
description: Denial of Service (DoS)
x_generator: engine: Vulnogram 0.0.9
source: advisory: JSA70213
defect: 1639998
discovery: USER
workarounds: value: There are no known workarounds for this issue.
exploits: value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: value: The following software releases have been updated to resolve this specific issue: 19.3R3-S7, 19.4R2-S8, 19.4R3-S10, 20.2R3-S6, 20.3R3-S5, 20.4R3-S5, 21.1R3-S4, 21.2R3, 21.3R3, 21.4R2, 22.1R1, and all subsequent releases.