Article Detail

Product Affected

This issue affects Contrail Networking.

Severity

Critical

Severity Assessment (CVSS) Score

9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities in third party software used in Juniper Networks Contrail Networking have been resolved in Release 1910.

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues include:

CVE	CVSS	Summary
CVE-2014-6394	7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)	visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
CVE-2016-3956	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )	The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
CVE-2016-4055	6.5 ( CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H )	The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
CVE-2017-18214	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )	The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
CVE-2018-10855	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )	Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
CVE-2018-10874	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
CVE-2018-10875	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
CVE-2018-16876	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N )	ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
CVE-2019-10744	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2019-10906	8.6 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N )	In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVE-2019-3828	10.0 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N )	Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
CVE-2019-9636	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.
CVE-2019-11324	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N )	The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVE-2017-18342	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
CVE-2015-5224	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
CVE-2015-5739	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
CVE-2015-5740	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
CVE-2016-2779	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
CVE-2016-4800	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
CVE-2017-13716	5.5 ( CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H )	The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
CVE-2017-14930	5.5 ( CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H )	Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
CVE-2017-15095	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blocklisting more classes that could be used maliciously.
CVE-2017-7525	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-7614	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.
CVE-2017-7656	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N )	In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
CVE-2017-7657	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
CVE-2017-7658	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
CVE-2017-8283	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
CVE-2017-8421	5.5 ( CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H )	The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.
CVE-2018-1126	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CVE-2018-11307	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVE-2018-12022	7.5 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H )	An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-12023	7.5 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H )	An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
CVE-2018-12699	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
CVE-2018-1320	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N )	Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
CVE-2018-14599	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.
CVE-2018-14600	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.
CVE-2018-14718	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2018-14719	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14720	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-14721	10.0 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2018-15686	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
CVE-2018-15688	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
CVE-2018-19360	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19362	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-5968	8.1 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blocklist.
CVE-2018-7489	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blocklist that is ineffective if the c3p0 libraries are available in the classpath.
CVE-2018-7738	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
CVE-2018-8012	7.5 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N )	No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
CVE-2019-1010238	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
CVE-2019-3462	8.1 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H )	Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
CVE-2019-9924	7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )	rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Solution

These issues have been resolved in Contrail Networking Release 1910.

This issue is being tracked as Contrail JIRA issues CEM-8320, CEM-8146, CEM-8567, CEM-6975, CEM-8477, CEM-8582, CEM-8583 and CEM-9136.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/ .

Workaround

There are no viable workarounds for all these issues.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History