{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39519", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2024-06-25T15:12:53.239Z", "datePublished": "2024-07-11T15:55:37.087Z", "dateUpdated": "2024-08-02T04:26:15.781Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["ACX7000 Series"], "product": "Junos OS Evolved", "vendor": "Juniper Networks", "versions": [{"status": "affected", "version": "22.1-EVO", "versionType": "semver"}, {"lessThan": "22.1R1-EVO", "status": "unaffected", "version": "0", "versionType": "semver"}, {"status": "affected", "version": "22.2-EVO", "versionType": "custom"}, {"status": "affected", "version": "22.3-EVO", "versionType": "custom"}, {"lessThan": "22.4R2-EVO", "status": "affected", "version": "22.4-EVO", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>To be potentially exposed to this issue the device must be configured as follows:</p><tt>[ routing-instances evpna instance-type evpn ]<br>[ routing-instances evpna routing-interface irb.0 ]</tt>"}], "value": "To be potentially exposed to this issue the device must be configured as follows:\n\n[ routing-instances evpna instance-type evpn ]\n[ routing-instances evpna routing-interface irb.0 ]"}], "datePublic": "2024-07-10T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a \n\n<span style=\"background-color: rgb(255, 255, 255);\">Denial-of-Service (DoS).</span><p>\n\n<span style=\"background-color: rgb(255, 255, 255);\">On all ACX 7000 Series platforms running \n\n<span style=\"background-color: rgb(255, 255, 255);\">Junos OS Evolved, and configured with IRBs</span>, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.</span><span style=\"background-color: rgb(255, 255, 255);\"><br></span></p><p>This issue affects Junos OS Evolved:&nbsp;</p><p>All versions from 22.2R1-EVO and later versions before 22.4R2-EVO,</p><p><span style=\"background-color: var(--wht);\">This issue does not affect Junos OS Evolved versions before 22.1R1-EVO.</span><br></p>"}], "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a \n\nDenial-of-Service (DoS).\n\nOn all ACX 7000 Series platforms running \n\nJunos OS Evolved, and configured with IRBs, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.\n\n\nThis issue affects Junos OS Evolved:\u00a0\n\nAll versions from 22.2R1-EVO and later versions before 22.4R2-EVO,\n\nThis issue does not affect Junos OS Evolved versions before 22.1R1-EVO."}], "exploits": [{"lang": "eng", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.&nbsp;However, multiple occurrences of this issue have been reported in production."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\u00a0However, multiple occurrences of this issue have been reported in production."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2024-07-11T15:55:37.087Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://supportportal.juniper.net/JSA82983"}], "solutions": [{"lang": "eng", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue: 22.4R2-EVO, 23.2R1-EVO, and all subsequent releases.<br>"}], "value": "The following software releases have been updated to resolve this specific issue: 22.4R2-EVO, 23.2R1-EVO, and all subsequent releases."}], "source": {"advisory": "JSA82983", "defect": ["1691134"], "discovery": "USER"}, "title": "Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenario", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There are no known workarounds for this issue."}], "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-11T18:57:45.856923Z", "id": "CVE-2024-39519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T18:57:54.595Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.781Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://supportportal.juniper.net/JSA82983"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-11T18:57:45.856923Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T18:57:50.859Z"}}], "cna": {"title": "Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenario", "source": {"defect": ["1691134"], "advisory": "JSA82983", "discovery": "USER"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Juniper Networks", "product": "Junos OS Evolved", "versions": [{"status": "affected", "version": "22.1-EVO", "versionType": "semver"}, {"status": "unaffected", "version": "0", "lessThan": "22.1R1-EVO", "versionType": "semver"}, {"status": "affected", "version": "22.2-EVO", "versionType": "custom"}, {"status": "affected", "version": "22.3-EVO", "versionType": "custom"}, {"status": "affected", "version": "22.4-EVO", "lessThan": "22.4R2-EVO", "versionType": "semver"}], "platforms": ["ACX7000 Series"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "eng", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\u00a0However, multiple occurrences of this issue have been reported in production.", "supportingMedia": [{"type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.&nbsp;However, multiple occurrences of this issue have been reported in production.", "base64": false}]}], "solutions": [{"lang": "eng", "value": "The following software releases have been updated to resolve this specific issue: 22.4R2-EVO, 23.2R1-EVO, and all subsequent releases.", "supportingMedia": [{"type": "text/html", "value": "The following software releases have been updated to resolve this specific issue: 22.4R2-EVO, 23.2R1-EVO, and all subsequent releases.<br>", "base64": false}]}], "datePublic": "2024-07-10T16:00:00.000Z", "references": [{"url": "https://supportportal.juniper.net/JSA82983", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue.", "supportingMedia": [{"type": "text/html", "value": "There are no known workarounds for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a \n\nDenial-of-Service (DoS).\n\nOn all ACX 7000 Series platforms running \n\nJunos OS Evolved, and configured with IRBs, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.\n\n\nThis issue affects Junos OS Evolved:\u00a0\n\nAll versions from 22.2R1-EVO and later versions before 22.4R2-EVO,\n\nThis issue does not affect Junos OS Evolved versions before 22.1R1-EVO.", "supportingMedia": [{"type": "text/html", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a \n\n<span style=\"background-color: rgb(255, 255, 255);\">Denial-of-Service (DoS).</span><p>\n\n<span style=\"background-color: rgb(255, 255, 255);\">On all ACX 7000 Series platforms running \n\n<span style=\"background-color: rgb(255, 255, 255);\">Junos OS Evolved, and configured with IRBs</span>, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.</span><span style=\"background-color: rgb(255, 255, 255);\"><br></span></p><p>This issue affects Junos OS Evolved:&nbsp;</p><p>All versions from 22.2R1-EVO and later versions before 22.4R2-EVO,</p><p><span style=\"background-color: var(--wht);\">This issue does not affect Junos OS Evolved versions before 22.1R1-EVO.</span><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "configurations": [{"lang": "en", "value": "To be potentially exposed to this issue the device must be configured as follows:\n\n[ routing-instances evpna instance-type evpn ]\n[ routing-instances evpna routing-interface irb.0 ]", "supportingMedia": [{"type": "text/html", "value": "<p>To be potentially exposed to this issue the device must be configured as follows:</p><tt>[ routing-instances evpna instance-type evpn ]<br>[ routing-instances evpna routing-interface irb.0 ]</tt>", "base64": false}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2024-07-11T15:55:37.087Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39519", "state": "PUBLISHED", "dateUpdated": "2024-07-11T18:57:54.595Z", "dateReserved": "2024-06-25T15:12:53.239Z", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "datePublished": "2024-07-11T15:55:37.087Z", "assignerShortName": "juniper"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C8ED590-BF68-44C7-971F-A237A0E20F8E", "versionEndExcluding": "22.4", "versionStartIncluding": "22.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*", "matchCriteriaId": "0A33C425-921F-4795-B834-608C8F1597E0", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*", "matchCriteriaId": "93887799-F62C-4A4A-BCF5-004D0B4D4154", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "62C473D2-2612-4480-82D8-8A24D0687BBD", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "7FB4C5CA-A709-4B13-A9E0-372098A72AD3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:acx7024:-:*:*:*:*:*:*:*", "matchCriteriaId": "1026737F-BA23-4550-9030-EA0502E97953", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7024x:-:*:*:*:*:*:*:*", "matchCriteriaId": "2FFFD74C-7BF9-4EAF-B364-356A8393712D", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7100-32c:-:*:*:*:*:*:*:*", "matchCriteriaId": "6FF19E76-F26B-4111-A814-BA7E5C3F2A74", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7100-48l:-:*:*:*:*:*:*:*", "matchCriteriaId": "F48C7E15-C23D-4E2D-9A1B-C314383C8C32", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7332:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B618533-4361-4175-B10B-D229B6D34C37", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7348:-:*:*:*:*:*:*:*", "matchCriteriaId": "8E5D2688-2C0D-4064-8B8F-343A7C604966", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:acx7509:-:*:*:*:*:*:*:*", "matchCriteriaId": "B50EC358-F551-4F2B-9DA1-61B6412AB957", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a \n\nDenial-of-Service (DoS).\n\nOn all ACX 7000 Series platforms running \n\nJunos OS Evolved, and configured with IRBs, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic.\n\n\nThis issue affects Junos OS Evolved:\u00a0\n\nAll versions from 22.2R1-EVO and later versions before 22.4R2-EVO,\n\nThis issue does not affect Junos OS Evolved versions before 22.1R1-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de verificaci\u00f3n inadecuada de las condiciones inusuales o excepcionales en el motor de reenv\u00edo de paquetes (PFE) de Juniper Networks Junos OS Evolved en la serie ACX7000 permite que un atacante adyacente no autenticado provoque una denegaci\u00f3n de servicio (DoS). En todas las plataformas de la serie ACX 7000 que ejecutan Junos OS Evolved y est\u00e1n configuradas con IRB, si un dispositivo de Customer Edge (CE) tiene conexi\u00f3n dual con dos dispositivos de borde del proveedor (PE), se producir\u00e1 un bucle de tr\u00e1fico cuando el CE env\u00ede paquetes de multidifusi\u00f3n. Este problema puede deberse al tr\u00e1fico IPv4 e IPv6. Este problema afecta a Junos OS Evolved: todas las versiones desde 22.2R1-EVO y versiones posteriores anteriores a 22.4R2-EVO. Este problema no afecta a las versiones de Junos OS Evolved anteriores a 22.1R1-EVO."}], "id": "CVE-2024-39519", "lastModified": "2024-11-21T09:27:54.717", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "LOW", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "NONE"}, "source": "sirt@juniper.net", "type": "Secondary"}]}, "published": "2024-07-11T16:15:02.717", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://supportportal.juniper.net/JSA82983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://supportportal.juniper.net/JSA82983"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "sirt@juniper.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}