CVE-2024-30397
Assigner: juniper
Published: 2024-04-12T15:25:54.567Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Junos OS
vendor: Juniper Networks
versions: lessThan: 20.4R3-S10
status: affected
version: 0
versionType: semver
lessThan: 21.2R3-S7
status: affected
version: 21.2
versionType: semver
lessThan: 21.4R3-S5
status: affected
version: 21.4
versionType: semver
lessThan: 22.1R3-S4
status: affected
version: 22.1
versionType: semver
lessThan: 22.2R3-S3
status: affected
version: 22.2
versionType: semver
lessThan: 22.3R3-S1
status: affected
version: 22.3
versionType: semver
lessThan: 22.4R3
status: affected
version: 22.4
versionType: semver
lessThan: 23.2R1-S2, 23.2R2
status: affected
version: 23.2
versionType: semver
configurations: supportingMedia: base64: no
type: text/html
value: To be affected by this issue, the following configuration is required on the device:<br>&nbsp; [ security ike proposal &lt;name&gt;authentication-method rsa-signatures ]<br>
value: To be affected by this issue, the following configuration is required on the device:
  [ security ike proposal <name>authentication-method rsa-signatures ]
datePublic: 2024-04-10T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: An Improper Check for Unusual or Exceptional Conditions vulnerability in the the&nbsp;Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS).<br><br>The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that a<span style="background-color: rgb(255, 255, 255);">ll subsequent VPN negotiations depending on certificate verification will fail.</span><br><br><span style="background-color: rgb(255, 255, 255);">This CPU utilization of pkid can be checked using this command: <br>&nbsp; root@srx&gt; show system processes extensive | match pkid<br>&nbsp; xxxxx  root  103  0  846M  136M  CPU1  1&nbsp;569:00 100.00% pkid<br><br>This issue affects:<br>Juniper Networks Junos OS<br><ul><li><span style="background-color: rgb(255, 255, 255);">All&nbsp;versions prior to 20.4R3-S10;</span></li><li><span style="background-color: rgb(255, 255, 255);">21.2 versions prior to 21.2R3-S7;</span></li><li><span style="background-color: rgb(255, 255, 255);">21.4 versions prior to 21.4R3-S5;</span></li><li>22.1 versions prior to 22.1R3-S4;</li><li>22.2 versions prior to&nbsp;22.2R3-S3;</li><li>22.3 versions prior to&nbsp;22.3R3-S1;</li><li>22.4 versions prior to&nbsp;22.4R3;</li><li>23.2 versions prior to&nbsp;23.2R1-S2, 23.2R2.</li></ul></span><br>
value: An Improper Check for Unusual or Exceptional Conditions vulnerability in the the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS).

The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that all subsequent VPN negotiations depending on certificate verification will fail.

This CPU utilization of pkid can be checked using this command: 
  root@srx> show system processes extensive | match pkid
  xxxxx  root  103  0  846M  136M  CPU1  1 569:00 100.00% pkid

This issue affects:
Juniper Networks Junos OS
  *  All versions prior to 20.4R3-S10;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.4 versions prior to 21.4R3-S5;
  *  22.1 versions prior to 22.1R3-S4;
  *  22.2 versions prior to 22.2R3-S3;
  *  22.3 versions prior to 22.3R3-S1;
  *  22.4 versions prior to 22.4R3;
  *  23.2 versions prior to 23.2R1-S2, 23.2R2.
exploits: supportingMedia: base64: no
type: text/html
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: NONE
attackVector: NETWORK
baseScore: 8.7
baseSeverity: HIGH
privilegesRequired: NONE
providerUrgency: NOT_DEFINED
subAvailabilityImpact: LOW
subConfidentialityImpact: NONE
subIntegrityImpact: NONE
userInteraction: NONE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
version: 4.0
vulnAvailabilityImpact: HIGH
vulnConfidentialityImpact: NONE
vulnIntegrityImpact: NONE
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
type: CWE
descriptions: description: Denial of Service (DoS)
solutions: supportingMedia: base64: no
type: text/html
value: The following software releases have been updated to resolve this specific issue: 20.4R3-S10, 21.2R3-S7, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S1, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.
value: The following software releases have been updated to resolve this specific issue: 20.4R3-S10, 21.2R3-S7, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S1, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases.
source: advisory: JSA79179
defect: 1745288
discovery: USER
title: Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) process
workarounds: supportingMedia: base64: no
type: text/html
value: <p>There are no known workarounds for this issue.</p>
value: There are no known workarounds for this issue.
x_generator: engine: Vulnogram 0.1.0-dev