CVSS: 5.9EPSS: 0%CPEs: 131EXPL: 0CVE-2022-22208 – Junos OS and Junos OS Evolved: An rpd crash can occur due to memory corruption caused by flapping BGP sessions
https://notcve.org/view.php?id=CVE-2022-22208
A Use After Free vulnerability in the Routing Protocol Daemon (rdp) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service (DoS). When a BGP session flap happens, a Use After Free of a memory location that was assigned to another object can occur, which will lead to an rpd crash. This is a race condition that is outside of the attacker's control and cannot be deterministically exploited. Continued flapping of BGP sessions can create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS: All versions prior to 18.4R2-S9, 18.4R3-S11; 19.1 versions prior to 19.1R3-S8; 19.2 version 19.2R1 and later versions; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R2-S1, 21.2R3. • https://kb.juniper.net/JSA69879 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 79EXPL: 0CVE-2022-22201 – SRX5000 Series with SPC3, SRX4000 Series, and vSRX: When PowerMode IPsec is configured, the PFE will crash upon receipt of a malformed ESP packet
https://notcve.org/view.php?id=CVE-2022-22201
An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). On SRX5000 Series with SPC3, SRX4000 Series, and vSRX, when PowerMode IPsec is configured and a malformed ESP packet matching an established IPsec tunnel is received the PFE crashes. This issue affects Juniper Networks Junos OS on SRX5000 Series with SPC3, SRX4000 Series, and vSRX: All versions prior to 19.4R2-S6, 19.4R3-S7; 20.1 versions prior to 20.1R3-S3; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R1-S2, 21.3R2. Una vulnerabilidad de comprobación inapropiada del índice, la posición o el desplazamiento especificados en la entrada en Packet Forwarding Engine (PFE) de Juniper Networks Junos OS permite a un atacante no autenticado basado en la red causar una Denegación de Servicio (DoS). En las series SRX5000 con SPC3, SRX4000 y vSRX, cuando es configurado PowerMode IPsec y es recibido un paquete ESP malformado que coincide con un túnel IPsec establecido, el PFE es bloqueado. • https://kb.juniper.net/JSA69900 • CWE-20: Improper Input Validation CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input •
CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2022-22192 – Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the device
https://notcve.org/view.php?id=CVE-2022-22192
An Improper Validation of Syntactic Correctness of Input vulnerability in the kernel of Juniper Networks Junos OS Evolved on PTX series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an incoming TCP packet destined to the device is malformed there is a possibility of a kernel panic. Only TCP packets destined to the ports for BGP, LDP and MSDP can trigger this. This issue only affects PTX10004, PTX10008, PTX10016. No other PTX Series devices or other platforms are affected. • https://kb.juniper.net/JSA69915 • CWE-20: Improper Input Validation CWE-1286: Improper Validation of Syntactic Correctness of Input •
CVSS: 9.8EPSS: 97%CPEs: 14EXPL: 23CVE-2022-42889 – Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
https://notcve.org/view.php?id=CVE-2022-42889
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default. • https://github.com/SeanWrightSec/CVE-2022-42889-PoC https://github.com/kljunowsky/CVE-2022-42889-text4shell https://github.com/korteke/CVE-2022-42889-POC https://github.com/cxzero/CVE-2022-42889-text4shell https://github.com/cryxnet/CVE-2022-42889-RCE https://github.com/akshayithape-devops/CVE-2022-42889-POC https://github.com/0xst4n/CVE-2022-42889 https://github.com/0xmaximus/Apache-Commons-Text-CVE-2022-42889 https://github.com/gustanini/CVE-2022-42889-Text4Shell-POC https:/&# • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-31173 – Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow
https://notcve.org/view.php?id=CVE-2022-31173
Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually. • https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28 https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22 https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j • CWE-400: Uncontrolled Resource Consumption CWE-674: Uncontrolled Recursion •