A vulnerability in BIND, used in Juniper Networks Junos OS on SRX Series devices, may allow an attacker on the network path for a transaction signature-signed request (TSIG-signed request), to trigger an assertion failure, resulting in a Denial of Service (DoS).
Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to cause a Denial of Service (DoS) condition.

This issue only affect SRX Series devices, which is the only platform that ships with BIND software. No other products or platforms are affected by this vulnerability.

This issue affects Juniper Networks Junos OS on SRX Series:

• 17.3 versions prior to 17.3R3-S11;
• 17.4 versions prior to 17.4R2-S12, 17.4R3-S3;
• 18.1 versions prior to 18.1R3-S11;
• 18.2 versions prior to 18.2R2-S8, 18.2R3-S7;
• 18.3 versions prior to 18.3R3-S4;
• 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S6;
• 19.1 versions prior to 19.1R1-S6, 19.1R3-S4;
• 19.2 versions prior to 19.2R1-S6, 19.2R3-S1;
• 19.3 versions prior to 19.3R2-S5, 19.3R3-S1;
• 19.4 versions prior to 19.4R2-S2, 19.4R3;
• 20.1 versions prior to 20.1R2;
• 20.2 versions prior to 20.2R1-S3, 20.2R2, 20.2R3.

The following minimal configuration is required:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during a external security research.

This issue has been assigned CVE-2020-8622 .

The following software releases have been updated to resolve this specific issue: 17.3R3-S11, 17.4R2-S12, 17.4R3-S3, 18.1R3-S11, 18.2R2-S8, 18.2R3-S7, 18.3R3-S4, 18.4R1-S8, 18.4R2-S7, 18.4R3-S6, 19.1R1-S6, 19.1R3-S4, 19.2R1-S6, 19.2R3-S1, 19.3R2-S5, 19.3R3-S1, 19.4R2-S2, 19.4R3, 20.1R2, 20.2R1-S3, 20.2R2, 20.2R3, 20.3R1, and all subsequent releases.

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

There are no viable workarounds for this issue.

2021-04-14: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2020-8622 at cve.mitre.org