CVE-2024-21605

{"id": "CVE-2024-21605", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-04-12T15:15:23.577", "references": [{"url": "https://supportportal.juniper.net/JSA75746", "source": "sirt@juniper.net"}, {"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "source": "sirt@juniper.net"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX 300 Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).\n\n\n\nSpecific valid link-local traffic is not blocked on ports in STP blocked state but is instead sent to the control plane of the device.\u00a0This leads to excessive resource consumption and in turn severe impact on all control and management protocols of the device.\n\n\n\nThis issue affects Juniper Networks Junos OS:\n * 21.2 version 21.2R3-S3 and later versions earlier than 21.2R3-S6;\n * 22.1 version 22.1R3 and later versions earlier than 22.1R3-S4;\n * 22.2 version \n\n22.2R2\n\nand later versions earlier than 22.2R3-S2;\n * 22.3 version \n\n22.3R2 \n\nand later versions earlier than 22.3R3-S1;\n\n * 22.4 versions earlier than 22.4R2-S2, 22.4R3;\n * 23.2 versions earlier than 23.2R1-S1, 23.2R2.\n\n\n\n\nThis issue does not affect Juniper Networks Junos OS 21.4R1 and later versions of 21.4.\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de exposici\u00f3n de recursos a una esfera incorrecta en el motor de reenv\u00edo de paquetes (PFE) de Juniper Networks Junos OS en la serie SRX 300 permite que un atacante adyacente no autenticado provoque una denegaci\u00f3n de servicio (DoS). El tr\u00e1fico de enlace local v\u00e1lido espec\u00edfico no se bloquea en los puertos en estado bloqueado STP, sino que se env\u00eda al plano de control del dispositivo. Esto conduce a un consumo excesivo de recursos y, a su vez, a un impacto severo en todos los protocolos de control y gesti\u00f3n del dispositivo. Este problema afecta a Juniper Networks Junos OS: * 21.2 versi\u00f3n 21.2R3-S3 y versiones posteriores anteriores a 21.2R3-S6; * 22.1 versi\u00f3n 22.1R3 y versiones posteriores anteriores a 22.1R3-S4; * 22.2 versi\u00f3n 22.2R2 y versiones posteriores anteriores a 22.2R3-S2; * 22.3 versi\u00f3n 22.3R2 y versiones posteriores anteriores a 22.3R3-S1; * Versiones 22.4 anteriores a 22.4R2-S2, 22.4R3; * Versiones 23.2 anteriores a 23.2R1-S1, 23.2R2. Este problema no afecta a Juniper Networks Junos OS 21.4R1 y versiones posteriores de 21.4."}], "lastModified": "2024-04-15T13:15:51.577", "sourceIdentifier": "sirt@juniper.net"}