Alert Type

SRN - Software Release Notification
Low/NotificationSoftware Release Notification
Low/NotificationSoftware Release Notification

Product Affected

EX4300-48MP in FIPS mode (see TSB71053 [juniper.net])

Alert Description

Junos Software Service Release version 19.4R3-S12 is now available for download from the Junos software download site. This software release is for EX4300-48MP in FIPS mode. See TSB70153 [juniper.net]

Download Junos Software Service Release:

  1. Go to Junos Platforms - Download Software page
  2. Input your product in the "Find a Product" search box
  3. From the Type/OS drop-down menu, select Junos SR
  4. From the Version drop-down menu, select your version
  5. Click the Software tab
  6. Select the Install Package as need and follow the prompts

Solution

Junos Software service Release version 19.4R3-S12 is now available.

19.4R3-S12 - List of Fixed issues 

PR NumberSynopsisCategory: Border Gateway Protocol
1679646The AGGREGATOR attribute will not be set correctly when the independent-domain is configured
Product-Group=junos		On all Junos and Junos OS Evolved platforms, in BGP(Border Gateway Protocol) deployments with the "independent-domain" and aggregate routes configured under routing-instance, the AGGREGATOR attribute encapsulated within the ATTR_SET will not be populated correctly. This can result in unintended behavior or service impact because the BGP neighbors receiving this update may discard it as it is not RFC complaint.
PR NumberSynopsisCategory: Enhanced Broadband Edge support for cos
1713968Subscribers connectivity is lost due to multiple MIC restart on all Junos MX platforms with MPC5E and BBE configuration
Product-Group=junos		On all Junos MX platforms with MPC5E and BBE (Broadband Edge) configuration, subscribers connectivity will be lost due to multiple MIC (Modular Interface Card) restart.
PR NumberSynopsisCategory: OpenSSH and related subsystems
1612947Junos OpenSSH leaves a dangling pointer
Product-Group=junos		On all Junos OS platforms, Junos OpenSSH might leave a dangling pointer that may cause the sshd to crash with core-dumps.
PR NumberSynopsisCategory: Device Configuration Daemon
1682271Node Slicing: In a rare scenario, the FPC/SLC will get stuck in the ready state after a restart
Product-Group=junos		On Junos MX platforms, in a rare scenario, FPC/SLC (Flexible PIC Concentrator/Sub Line Card) may get stuck in the ready state after restarting it and the error message of 'Device busy' will be observed in Syslog.
PR NumberSynopsisCategory: Express ASIC platform
1683562On PTX5000 platforms when a command is issued to power off an FPC, it gets stuck in the 'Announce Offline' state
Product-Group=junos		When an FPC (Flexible PIC Concentrator) on PTX5000 platforms is shut down by issuing a request command (request chassis offline slot ) or by FPC power off configuration (set chassis fpc x power off), it gets stuck in the 'Announce Offline' state since the associated timer (fru_graceful_offline_timer) doesn't increment and expire as it is supposed to.
PR NumberSynopsisCategory: ISIS routing protocol
1677567Label traffic will be dropped at the one-hop LSP stitching node if the packet has more than one label
Product-Group=junos		On all Junos and Junos Evolved platforms supporting the Segment Routing (SR) feature, when segment routing and Label Distribution Protocol (LDP) stitching are configured, the label traffic drop is observed at the one-hop Label Switched Path (LSP) stitching node when the labeled packet is received with more than one label.
PR NumberSynopsisCategory: Layer 2 Circuit issues
1691295Post FPC restart CCC status is getting wrongly updated on the local interface
Product-Group=junos		On all Junos and Junos Evolved platforms in the L2VPN (Layer 2 Virtual Private Network) scenario, the CCC (Circuit Cross-Connect) link status will remain up after the FPC (Flexible PIC Concentrators) restart, when the CCC status is down between the local PE-CE link.
PR NumberSynopsisCategory: lacp protocol
1609618LACP Member interfaces might get stuck in out of sync state.
Product-Group=junos		When sync-reset feature is enabled on the device then few member interfaces might stay in out of sync state even when number of available child interfaces is greater than minimum-links configured for the Lag interface. This will affect the overall capacity of the lag interface .
PR NumberSynopsisCategory: Track Mt Rainier SPMB platform software issues
1637950SPMB might crash immediately after a switchover
Product-Group=junos		On the PTX5000 line of routers with dual Routing Engines and equipped with SPMB type PTX5K CB PMB, immediately after a switchover, if the new primary Switch Processor Mezzanine Board (SPMB) finds any CB-to-SIB PCI (Control Board - Switch Interface Board Peripheral Component Interconnect) link down error, then the new primary SPMB might crash. This causes the device to silently discard packets for about 2-3 minutes while the Switch Interface Boards (SIBs) are re-initialized.
PR NumberSynopsisCategory: FreeBSD Kernel Infrastructure
1669072Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery (CVE-2023-28972)
Product-Group=junos		An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. Please refer to https://supportportal.juniper.net/JSA70596 [juniper.net] for more information.
1704032VM process crashes if a file is shared between the host operating system and the guest operating system using virtFS
Product-Group=junos		On Virtual Machines (VM) based platforms running Junos images, files are not shared between the host operating system and guest operating system via Virtual Filesystem (virtFS). When this issue happens, the device will be restarted.
PR NumberSynopsisCategory: Kernel MPLS / Tag / P2MP Infrastructure
1723145Routing engine initiated PING failed over MPLS interface
Product-Group=junos		The RE-generated packets that have MTU size greater than the inet MTU size get dropped when going out on an interface with MPLS chain-composite-next-hop.
PR NumberSynopsisCategory: IPSEC functionality on M/MX/T ser
1630070The kmd process might crash with core files every few minutes on MX Series routers
Product-Group=junos		On MX Series routers in the IPSEC VPN scenario, the kmd process might crash every few minutes due to a timing issue in the establishment phase, which leads to IPSEC VPN flapping.
PR NumberSynopsisCategory: Stout cards (MPC7, MPC8, MPC9) microkernel issues
1727427FPC crash observed when the ASIC usage is high
Product-Group=junos		On platforms with MS-MPC/MPC1/2/3/4/5/6/7/8/9 line cards and EX9200/EX9204/EX9208/EX9214/EX9251/EX9253 series devices, route churn (add or deletes) when the ASIC usage crosses a threshold (ASIC usage is high) which leads to a FPC crash.
PR NumberSynopsisCategory: Trio pfe bridging, learning, stp, oam, irb software
1643416RE switchover may result in traffic loss in a certain scenario
Product-Group=junos		On all Junos platforms that support MPLS with GRES and NSR enabled, on RE switchover through CLI or system reboot, traffic loss may happen.
PR NumberSynopsisCategory: DDos Support on MX
1549656The kernel might crash if GRES is performed on either new iteration or after swapping the Routing Engine and restoring the HA configuration
Product-Group=junos		On dual Routing Engine platforms with only two slots, the kernel crash may be seen on the backup Routing Engine after performing multiple GRES.
PR NumberSynopsisCategory: Junos Automation, Commit/Op/Event and SLAX
1717425Junos platform device unable to commit configuration in recovery mode
Product-Group=junos		On all Junos platforms where snapshot is supported, when a device is rebooted from recovery mode it fails to commit configuration due to problems with slax import and device might go into amnesiac mode due commit fail.
 
 

19.4R3-S12 - List of Known issues 

PR NumberSynopsisCategory: "agentd" software daemon
1647568SDN-Telemetry process crash during longevity tests of Streaming telemetry.
Product-Group=junos		On all Junos platforms, agentd process crash will be seen in telemetry streaming longevity test.

Resolved In: 
PR NumberSynopsisCategory: Border Gateway Protocol
1669716The rpd crash is observed while making configurational changes
Product-Group=junos		On all Junos and Junos Evolved platforms, which supports protocol BGP (Border Gateway Protocol), RPD (Routing Protocol daemon) crash is seen when a eBGP peering interface is moved to a "no-forwarding" instance and resetting the BGP peer.

Resolved In: evo:21.4R3-EVO evo:22.1R3-EVO evo:22.2R2-EVO evo:22.3R1-EVO evo:22.4R1-EVO junos:20.2R3-S8 junos:20.4R3-S4 junos:21.1R3-S4 junos:21.2R3-S3 junos:21.3R3-S2 junos:21.4R3 junos:22.1R3 junos:22.2R2 junos:22.3R1 junos:22.4R1
1690213BMP will not send EOR message
Product-Group=junos		On all Junos and Junos Evolved platforms, BMP(BGP Monitoring Protocol) will not send EOR(End of RIB) message for some releases. This will impact some data collections.

Resolved In: evo:22.2R3-EVO evo:22.3R2-EVO evo:22.4R2-EVO evo:23.1R1-EVO evo:23.2R1-EVO evo:23.3R1-EVO junos:22.2R3 junos:22.3R2 junos:22.4R2 junos:23.1R1 junos:23.2R1 junos:23.3R1
PR NumberSynopsisCategory: Firewall support for DNX
1653475Junos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is used (CVE-2023-28961)
Product-Group=junos		An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent the firewall filter term 'from next-header ah' from being properly installed in the packet forwarding engine (PFE). There is no immediate indication of an incomplete firewall filter commit shown at the CLI, which could allow an attacker to send valid packets to or through the device that were explicitly intended to be dropped. https://supportportal.juniper.net/JSA70586 [juniper.net] for more information.

Resolved In: junos:20.2R3-S7 junos:20.4R3-S4 junos:21.1R3-S3 junos:21.2R3-S4 junos:21.3R3 junos:21.4R3 junos:22.1R2 junos:22.2R1 junos:22.3R1
PR NumberSynopsisCategory: Track Mt Rainier RE platform software issues
1386306The log message of 'kernel: interrupt storm detected on "irq11:"; throttling interrupt source' might be seen when NG-RE is used
Product-Group=junos		With Next Generation Routing Engine (NG-RE), in some race conditions, the following interrupts messages might be seen on master RE: kernel: interrupt storm detected on "irq11:"; throttling interrupt source

Resolved In: 
PR NumberSynopsisCategory: FreeBSD Kernel Infrastructure
1586481Software Image Upgrade from versions 21.1 (or earlier) to version 21.2 (or later) requires mandatory knob 'no-validate'
Product-Group=junos		While upgrading the image from 21.2T to 21.3DCB, the no-validate knob is mandatory for the upgrade command to proceed.

Resolved In: 
PR NumberSynopsisCategory: Issues related to PKI daemon
1509250The PKI key-pair and certification might not be synchronized to the new RE
Product-Group=junos		In IPsec VPN with PKI (Public Key Infrastructure) scenario, if the hardware of RE is replaced with the new same model or zeroized, the PKI certificate/key-pair might not be synchronized to this RE, because some appropriate files related to certificate/key-pair might not be replicated correctly. Then the IPsec VPN tunnel might be failed.

Resolved In: junos:20.3R2 junos:20.4R1
PR NumberSynopsisCategory: JRR - VRR running on SRX4200
1677503Junos OS: JRR200: Kernel crash upon receipt of a specific packet (CVE-2023-28970)
Product-Group=junos		An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing on the network interfaces of Juniper Networks Junos OS on JRR200 route reflector appliances allows an adjacent, network-based attacker sending a specific packet to the device to cause a kernel crash, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Please refer to https://supportportal.juniper.net/JSA70594 [juniper.net] for more information.

Resolved In: junos:21.2R3-S4 junos:21.3R3-S4 junos:21.4R3-S3 junos:22.1R3-S1 junos:22.2R2-S2 junos:22.2R3 junos:22.3R1-S2 junos:22.3R2 junos:22.3R2-S1 junos:22.3R3 junos:22.4R1-S1 junos:22.4R2 junos:23.1R1
PR NumberSynopsisCategory: PPPoE functional plugin for bbe-smgd
1685070Multiple bbe-smgd cores might be observed resulting in subscribers being lost or failing to login in the Enhanced subscriber scenario
Product-Group=junos		On MX platforms, multiple bbe-smgd cores might be observed due to out-of-bound memory access in the Enhanced subscriber scenario when bringing up PPPoE (Point-to-Point Protocol over Ethernet) subscribers and ACI (agent circuit identifier)/ARI (agent remote identifier) are part of the payload.

Resolved In: evo:22.1R3-EVO evo:22.2R3-EVO evo:22.3R2-EVO evo:22.4R1-EVO evo:23.1R1-EVO junos:19.4R3-S10 junos:19.4R3-S5-J1 junos:20.2R3-S4-J9 junos:20.2R3-S6 junos:20.3R3-S6 junos:20.4R3-S5 junos:21.1R3-S4 junos:21.2R3-S3 junos:21.3R3-S3 junos:21.4R3-S1 junos:22.1R3 junos:22.2R2 junos:22.2R3 junos:22.3R2 junos:22.4R1 junos:23.1R1

Modification History

2023-06-26 Correction on the platform supported to be EX4300-48MP per TSB70153 [juniper.net]
First publication 2023-06-20