Article Detail

Product Affected

Session Smart Router (SSR)

Severity

None

Severity Assessment (CVSS) Score

7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Problem

This Reference Juniper Security Advisory (JSA) presents an analysis of several vulnerabilities identified through Qualys scans, including issues in Squid proxy, Node.js 14, OpenSSH, CentOS 7, and deprecated SSH cryptographic settings.

Upon internal analysis, these findings have been assessed as false positives for the Juniper Session Smart Router (SSR) platform as detailed below:

Qualys ID	CVE(s)	Description	Threat	Impact	Affected versions	Solution/ Workaround
375570	CVE-2021-28651, CVE-2021-31807, CVE-2021-31808, CVE-2021-31806, CVE-2021-28662, CVE-2021-28652	Squid Multiple Denial Of Service Vulnerability (SQUID-2021:1,SQUID-2021:2,SQUID-2021:3,SQUID-2021:4,SQUID-2021:5)	Successful exploitation of these vulnerabilities may allow an attacker to crash squid against all clients using the proxy.	Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages.	SQUID-2021:1 : Squid from 2.0 to 4.14 and from 5.0.1 to 5.0.5 SQUID-2021:2 : Squid from 4.0.1 to 4.14 and from 5.0.1 to 5.0.5 SQUID-2021:3 : Squid from 1.0 to 4.14 and from 5.0 to 5.0.5 SQUID-2021:4 : Squid from 2.5.STABLE2 to 2.7.STABLE9 and from 3.0 to 4.1.4 and from 5.0.1 to 5.0.5 SQUID-2021:5 : Squid less than 4.15 and from 5.0 to 5.0.5 QID Detection Logic: This QID checks for vulnerable version of Squid.	Based on squid’s change log for the version of squid (squid-7:3.5.20-17.0.1.el7_9.10.x86_64) contained within SSR-6.1.10, the following CVEs were remediated: * Thu Apr 11 2024 EL Errata [email protected] - 7:3.5.20-17.0.1 - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-2021-31806,31807,31808 squid: Handle more Range requests (#790) - Resolves: CVE-2021-33620 squid: Handle more partial responses (#791)
106198		EOL/Obsolete Software: Node.js 14.x Detected	The system is at high risk of being exposed to security vulnerabilities because the vendor no longer provides updates.	Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside of a web browser. According to Node.js Released page Node.js 14.x is no longer supported from 2023-04-30 and will not be getting regular patches. QID Detection: (Authenticated) Windows: Checks for installed end of life Node.js version using. Detection for windows will only work if Node.js is installed using msi. Linux: This QID executes the commands "npm version \| grep -i node \| head -1;npm config get prefix" and checks the version. Also, it checks the node.js version by checking the node binary for the underlying version.	Update to the latest version of Node.js.	Because node.js 14 is out of support, Juniper maintains node.js 14 by manually updating it from upstream enterprise Linux repositories. The current version of node.js was re-built from Oracle's nodejs14, fully maintained and free from current CVE (as of 6.1.10 release date) from Oracle Linux 7 repository. The version of node 14 running is: rh-nodejs14-nodejs-14.21.3-6.
106228		EOL/Obsolete Operating System: CentOS 7.x Detected	The system is at high risk of being exposed to security vulnerabilities. Since the vendor no longer provides updates, obsolete software is more vulnerable to viruses and other attacks.	The host is running on CentOS 7.x. CentOS ends support for CentOS Linux 7 on June 30, 2024, and provides no further support for this operating system.		Juniper stopped using CentOS with its release of SSR-6.0.0. Instead, the SSR’s upstream enterprise Linux repository is Oracle Linux 7, which is now in Extended Support. The SSR software has moved to Oracle Linux 9 in its SSR-7.0 software release.
38909		SHA1 deprecated setting for SSH	Vulnerable to collision attacks, which are designed to fabricate the same hash value for different input data.each hash is supposedly unique.	The SSH protocol (Secure Shell) is a method for secure remote login from one computer to another. The target is using deprecated SHA1 cryptographic settings to communicate.		SHA1 is considered a weaker cryptographic algorithm. SSR can be instructed to disable SHA1 by enabling FIPS mode. Enabling FIPS mode however may have implications on a customer's environment depending on the feature in use, and will require thorough retesting by CVS in their lab for interoperability with other devices before this can be enabled.
105936	CVE-2020-15778	OpenSSH Command Injection Vulnerability (Generic)	Successful exploitation could disclose sensitive information.	OpenSSH is the premier connectivity tool for remote login with the SSH protocol. scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.	8.3p1 and prior versions of OpenSSH QID Detection Logic: The QID checks for the vulnerable versions of OpenSSH and checks the presence of scp command by executing 'which scp' Note : Affected version checked till 8.3p1 as per PoC.	CVE-2020-15778 7.8 was DISPUTED by the OpenSSH team. They declined to fix the parser in a maintenance release on the basis that it would break backward compatibility of scp. Instead, scp is being deprecated in newer OpenSSH releases in favor of using sftp. OpenSSH reply per GitHub - https://github.com/cpandya2909/CVE-2020-15778/: “The scp command is a historical protocol (called rcp) which relies upon that style of argument passing and encounters expansion problems. It has proven very difficult to add "security" to the scp model. All attempts to "detect" and "prevent" anomalous argument transfers stand a great chance of breaking existing workflows. Yes, we recognize it the situation sucks. But we don't want to break the easy patterns people use scp for, until there is a commonplace replacement. People should use rsync or something else instead if they are concerned.” Juniper is following the community’s stance on OpenSSH. This issue should be treated as resolved when SSR upgrades to a version of OpenSSH that no longer contains scp.
374431	CVE-2019-12522	Squid Proxy Elevation Of Privilege Vulnerability	This is trivial vulnerability, successful exploitation results in the child process to escalate their privileges back to root.	Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages.	Squid from 3.0 to 3.5.28 Squid from 4.0 to 4.7 Squid from 5.0 to 5.0.1 QID Detection Logic: This QID checks for a vulnerable version of Squid.	SSR-6.1.10 uses squid-7:3.5.20-17.0.1.el7_9.10.x86_64, which does not contain this vulnerability.
379320	CVE-2024-23638	Squid Proxy Denial of Service (DoS) Vulnerability (SQUID-2023:11)	Successful exploitation of this vulnerability can result in Denial of Service	Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. CVE-2024-23638 - Due to an expired pointer reference bug Squid is vulnerable to a Denial of Service attack against Cache Manager error responses.	Squid from 0.x to v5.9 Squid from 6.x to 6.5 QID Detection Logic:(Authenticated) Linux - This QID checks for vulnerable version of Squid by utilizing the command: /usr/sbin/squid -v and /usr/local/squid/sbin/squid -v.	SSR version SSR-6.1.14 is upgrading to squid-7:3.5.20-17.0.5.el7_9.13.x86_64. This version of squid was upgraded to address CVE-2023-46846 in April of 2025. squid-7:3.5.20-17.0.5.el7_9.13.x86_64 is currently the latest version from squid.
38913	CVE-2023-48795	SSH Prefix Truncation Vulnerability (Terrapin)	Successful exploitation of the vulnerability may allow an attacker to downgrade the security of an SSH connection when using SSH extension negotiation. The impact in practice heavily depends on the supported extensions. Most commonly, this will impact the security of client authentication when using an RSA public key.	The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago. Since then, these have been adopted by a wide range of SSH implementations, therefore affecting a majority of current implementations. QID Detection Logic (Unauthenticated): This detection attempts to start the SSH key exchange process and examines whether either of the vulnerable ChaCha20-Poly1305 Algorithm or CBC-EtM Algorithm is active. It subsequently verifies whether Strict Key Exchange is enabled. If a target is identified as vulnerable, it indicates that the target supports either of the vulnerable algorithms and lacks support for Strict Key Exchange.		SSR version SSR-6.1.10 addressed this vulnerability by upgrading to openssh-0:7.4p1-23.0.3.el7_9.x86_64.

Solution

Refer to the table above to assess impact.

Workaround

Refer to the table above for applicable workarounds.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History