Juniper Releases Patches for Critical Bugs in Junos OS and Contrail Networking


Juniper Networks Pushed Security Updates to Address various vulnerabilities that affect multiple products, some of which can be exploited to seize control of the affected systems.

The most critical flaws relate to Junos Space and Contrail Networking, with the tech company urging customers to release versions 22.1R1 and 21.4.0, respectively.

Chief among these is a collection of 31 bugs in the Junos Space network management software, including CVE-2021-23017 (CVSS score: 9.4) that can lead to a crash of vulnerable devices or even arbitrary code execution.

“A security vulnerability has been identified in the nginx resolver that could allow an attacker who could spoof UDP packets from the DNS server to overwrite 1-byte of memory, which could lead to a worker process crash or other possible impact,” the company said. said.

The same security vulnerability is also recovered in Northstar Controller in versions 5.1.0 Service Pack 6 and 6.2.2.

In addition, the network equipment manufacturer warned against: multiple known issues exists in CentOS 6.8 previously shipped with Junos Space Policy Enforcer version 22.1R1. As a fix, the version of CentOS packaged with the Policy Enforcer component has been upgraded to 7.9.

Also listed are 166 vulnerabilities affecting the Contrail Networking product that affect all versions prior to 21.4.0 and collectively received the maximum CVSS score of 10.0.

Multiple vulnerabilities in third-party software used in Juniper Networks Contrail Networking have been resolved in release 21.4.0 by upgrading the Open Container Initiative (OCI)-compliant Red Hat Universal Base Image (UBI) container image from Red Hat Enterprise Linux 7 to Red Hat Enterprise Linux 8,” it noted in an opinion.