IPython, shipped with Juniper Networks Junos OS Evolved, is subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same system.
 

IPython is only accessible from the Junos OS Evolved shell, and not normally used in production.
 

This issue affects Juniper Networks Junos OS Evolved:

• All versions earlier than 20.4R2-EVO;
• 21.1-EVO versions earlier than 21.1R2-EVO;
• 21.3-EVO versions earlier than 21.3R2-EVO;
• 21.4-EVO versions earlier than 21.4R3-S6-EVO;
• 22.1-EVO versions earlier than 22.1R3-S5-EVO;
• 22.2-EVO versions earlier than 22.2R3-S3-EVO;
• 23.2-EVO versions earlier than 23.2R2-EVO.

This issue does not affect Juniper Networks Junos OS Evolved:

• 21.2-EVO;
• 22.3-EVO;
• 22.4-EVO.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned CVE-2022-21699.
 

The following software releases have been updated to resolve this specific issue: 20.4R2-EVO, 21.1R2-EVO, 21.3R2-EVO, 21.4R3-S6-EVO, 22.1R3-S5-EVO, 22.2R3-S3-EVO, 22.3R1-EVO, 22.4R1-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.

This issue is being tracked as PR 1745190 which is visible on the Customer Support website.
 

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

2024-01-10: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2022-21699 at cve.mitre.org