title: Junos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS)
description: An Improper Input Validation vulnerability in ingress TCP segment processing of Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker to send a crafted TCP segment to the device, triggering a kernel panic, leading to a Denial of Service (DoS) condition. Continued receipt and processing of this TCP segment could create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS Evolved: 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R2-EVO; 22.1 versions prior to 22.1R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 21.3R1-EVO.
problem types: CWE-20 Improper Input Validation
affected:
{
vendor: Juniper Networks
product: Junos OS Evolved
versions:
version: unspecified, lessThan: 21.3R1-EVO, status: unaffected, versionType: custom
version: 21.3-EVO, status: affected, lessThan: 21.3R3-EVO, versionType: custom
version: 21.4-EVO, status: affected, lessThan: 21.4R2-EVO, versionType: custom
version: 22.1-EVO, status: affected, lessThan: 22.1R2-EVO, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS Evolved 21.3R3-EVO, 21.4R2-EVO, 22.1R2-EVO, 22.2R1-EVO, and all subsequent releases.
workarounds: There are no viable workarounds for this issue.