Article Detail

Product Affected

This issue affects Contrail Cloud.

Severity

Critical

Severity Assessment (CVSS) Score

9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities in third party software used in Juniper Networks Contrail Cloud have been resolved in release 13.6.0.

These issues affects Juniper Networks Contrail Cloud versions prior to 13.6.0.

This issue was seen during production usage.

Important security issues resolved include:

CVE	CVSS	Summary
CVE-2017-15715	8.1 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H )	In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
CVE-2018-20836	8.1 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H )	An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
CVE-2018-20843	7.5 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVE-2019-5482	9.8 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-12450	9.8 ( CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )	file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
CVE-2019-14866	6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C	In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
CVE-2019-15917	6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C	An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.
CVE-2019-17546	6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P	tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-19046	6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C	DISPUTED A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time.
CVE-2019-19447	6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P	In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.
CVE-2019-19807	7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C	In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
CVE-2019-20636	7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C	In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7.
CVE-2020-17376	6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P	An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

Solution

The following software releases have been updated to resolve these specific issues: Contrail Cloud 13.6.0, and all subsequent releases.

This issue is being tracked as CC-723.

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

Workaround

There are no known workarounds for this issue.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History