A vulnerability in Juniper Networks Junos OS on SRX Series, allows a network-based unauthenticated attacker to cause a Denial of Service (DoS) by sending a specific fragmented packet to the device, resulting in a flowd process crash, which is responsible for packet forwarding. Continued receipt and processing of this specific packet will create a sustained DoS condition. This issue only affects SRX Series when 'preserve-incoming-fragment-size' feature is enabled. This issue affects Juniper Networks Junos OS on SRX Series: 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect Juniper Networks Junos OS prior to 17.3R1.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
Vendors | Products |
---|---|
Juniper |
|
Configuration 1 [-]
AND |
|
No data.
References
Link | Providers |
---|---|
https://kb.juniper.net/JSA69493 |
History
Mon, 16 Sep 2024 22:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Title | Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet | Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet |
MITRE
Status: PUBLISHED
Assigner: juniper
Published: 2022-04-14T15:50:42.148265Z
Updated: 2024-09-16T22:20:45.803Z
Reserved: 2021-12-21T00:00:00
Link: CVE-2022-22185
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-04-14T16:15:07.930
Modified: 2024-11-21T06:46:20.703
Link: CVE-2022-22185
Redhat
No data.