A Use of a Broken or Risky Cryptographic Algorithm vulnerability in OpenSSL of Juniper Networks Junos OS allows a remote attacker to obtain sensitive information, caused by improper encryption of data by the AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation.

By sending a specially-crafted request, an attacker can exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.

This issue affects Juniper Networks Junos OS:
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

The important security issues resolved are described below:

This issue is resolved in OpenSSL 1.1.1q.

The following software releases have been updated to resolve this specific issue:

Junos OS: 22.1R3, 22.2R2, 22.3R1, 22.3R2, and all subsequent releases.

This issue is being tracked as PR 1675447 which is visible on the Customer Support website.

Note: Juniper SIRT's policy [juniper.net] is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue.

To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks, hosts and users.

2023-10-11: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://supportportal.juniper.net/JSA73176 [juniper.net]