title: SRC Series: NETCONF over SSH allows negotiation of weak ciphers
description: An Information Exposure vulnerability in Juniper Networks SRC Series devices configured for NETCONF over SSH permits the negotiation of weak ciphers, which could allow a remote attacker to obtain sensitive information. A remote attacker with read and write access to network data could exploit this vulnerability to display plaintext bits from a block of ciphertext and obtain sensitive information. This issue affects all Juniper Networks SRC Series versions prior to 4.13.0-R6.
problem types: CWE-200 Information Exposure
affected:
{
product: SRC Series
vendor: Juniper Networks
versions:
lessThan: 4.13.0-R6, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: A hotfix has been created to resolve this issue.  Contact Juniper Networks Technical Support to request the hotfix.
Weak ciphers are now disabled by default. Only the following ciphers and key-exchange (KEX) algorithms are now enabled by default:
• Ciphers: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
• KEX Algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
Note: After upgrading to a fixed release, any manually configured weak ciphers or KEX algorithms for NETCONF will be retained.  Administrators should reset their cipher configuration by typing:
root@src# delete system services netconf ssh
root@src# commit
Stopping NETCONF/SSH:
commit complete.
root@src# set system services netconf ssh
workarounds: There are no viable workarounds for this issue.