Alert Type
SRN - Software Release Notification
Risk
Risk Description
Low/Notification
Software Release Notification
Impact
Impact Description
Low/Notification
Software Release Notification
Product Affected
MX10003 running Junos FIPS software
Alert Description
Junos Software Service Release version 19.3R3-S8 is now available for download from the Junos software download site
Download Junos Software Service Release:
Go to
Junos Platforms - Download Software page
Input your product in the "Find a Product" search box
From the Type/OS drop-down menu, select
Junos SR
From the Version drop-down menu, select your version
Click the Software tab
Select the Install Package as need and follow the prompts
Solution
Junos Software service Release version 19.3R3-S8 is now available.
19.3R3-S8 - List of Fixed issues
PR Number
Synopsis
Category: BBE interface related issues
1681389
Junos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from subscribers the process bbe-smgd will crash (CVE-2023-28974)
Product-Group=junos
An Improper Check for Unusual or Exceptional Conditions vulnerability in the bbe-smgd of Juniper Networks Junos OS allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/
JSA70599
[juniper.net]
for more information.
PR Number
Synopsis
Category: Border Gateway Protocol
1679646
The AGGREGATOR attribute will not be set correctly when the independent-domain is configured
Product-Group=junos
On all Junos and Junos OS Evolved platforms, in BGP(Border Gateway Protocol) deployments with the "independent-domain" and aggregate routes configured under routing-instance, the AGGREGATOR attribute encapsulated within the ATTR_SET will not be populated correctly. This can result in unintended behavior or service impact because the BGP neighbors receiving this update may discard it as it is not RFC complaint.
1739919
Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute (CVE-2023-0026)
Product-Group=junos
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/
JSA71542
[juniper.net]
for more details.
PR Number
Synopsis
Category: Express PFE L2 fwding Features
1667678
Junos OS: QFX10000 Series, PTX1000 Series: The dcpfe process will crash when a malformed ethernet frame is received (CVE-2023-1697)
Product-Group=junos
An Improper Handling of Missing Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a dcpfe process core and thereby a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/
JSA70612
[juniper.net]
for more information.
1686793
Junos OS: QFX10002: PFE wedges and restarts upon receipt of specific malformed packets (CVE-2023-28959)
Product-Group=junos
QFX10002 allows an unauthenticated, adjacent attacker on the local broadcast domain sending a malformed packet to the device, causing all PFEs other than the inbound PFE to wedge and to eventually restart, resulting in a Denial of Service (DoS) condition. Please refer to https://supportportal.juniper.net/
JSA70584
[juniper.net]
for more information
PR Number
Synopsis
Category: Firewall Policy
1694222
Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open (CVE-2023-28968)
Product-Group=junos
An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature component of Junos OS's AppID service on SRX Series devices will stop the JDPI-Decoder from identifying dynamic application traffic, allowing an unauthenticated network-based attacker to send traffic to the target device using the JDPI-Decoder, designed to inspect dynamic application traffic and take action upon this traffic, to instead begin to not take action and to pass the traffic through. Please refer to https://supportportal.juniper.net/
JSA70592
[juniper.net]
for more information.
PR Number
Synopsis
Category: Security platform jweb support
1698072
Junos OS: Multiple vulnerabilities in J-Web(CVE-2023-28962)
Product-Group=junos
An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. Please refer to https://supportportal.juniper.net/
JSA70587
[juniper.net]
for more information.
1698075
Junos OS: Multiple vulnerabilities in J-Web (CVE-2023-28963)
Product-Group=junos
An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to read arbitrary files from temporary folders on the device. Please refer to https://supportportal.juniper.net/
JSA70587
[juniper.net]
for more information.
PR Number
Synopsis
Category: lacp protocol
1609618
LACP Member interfaces might get stuck in out of sync state
Product-Group=junos
When sync-reset feature is enabled on the device then few member interfaces might stay in out of sync state even when number of available child interfaces is greater than minimum-links configured for the Lag interface. This will affect the overall capacity of the lag interface.
PR Number
Synopsis
Category: FreeBSD Kernel Infrastructure
1669072
Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery (CVE-2023-28972)
Product-Group=junos
An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. Please refer to https://supportportal.juniper.net/
JSA70596
[juniper.net]
for more information.
1688079
Junos OS: Multiple vulnerabilities in expat resolved
Product-Group=junos
Multiple vulnerabilities in the third party software component expat have been resolved. Please refer to https://supportportal.juniper.net/
JSA70605
[juniper.net]
for more information.
1704032
VM process crashes if a file is shared between the host operating system and the guest operating system using virtFS
Product-Group=junos
On Virtual Machines (VM) based platforms running Junos images, files are not shared between the host operating system and guest operating system via Virtual Filesystem (virtFS). When this issue happens, the device will be restarted.
1638519
Junos OS: The kernel will crash when certain USB devices are inserted (CVE-2023-28975)
Product-Group=junos
An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/
JSA70600
[juniper.net]
for more information.
PR Number
Synopsis
Category: Trio pfe l3 forwarding issues
1647532
Junos OS: MX Series: If a specific traffic rate goes above the DDoS threshold leads to an FPC crash (CVE-2023-28976)
Product-Group=junos
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated attacker to cause a Denial of Service (DoS). Please refer to https://supportportal.juniper.net/
JSA70601
[juniper.net]
for more information.
PR Number
Synopsis
Category: Junos Automation, Commit/Op/Event and SLAX
1717425
Junos platform device unable to commit configuration in recovery mode
Product-Group=junos
On all Junos platforms where snapshot is supported, when a device is rebooted from recovery mode it fails to commit configuration due to problems with slax import and device might go into amnesiac mode due commit fail.
PR Number
Synopsis
Category: Issues related to all UI tools (mgd-bsd/cli-bsd, XML and DMI
1681656
System uptime display is shown in minutes instead of seconds
Product-Group=junos
On all Junos and Junos Evolved platforms, after the device reboot, show system uptime command is showing time in minutes instead of seconds for 24 hours.
19.3R3-S8 - List of Known issues
PR Number
Synopsis
Category: Trio pfe qos software
1681162
The MPC crashes when interfaces move in and out from an AE bundle or subscribers log in and out
Product-Group=junos
This issue occurs on Junos MX Series routers in a scaled setup when the physical interface (IFD) moves in and out from an aggregated Ethernet bundle or subscribers log in and out before the subscriber was cleaned up. This triggers high CPU usage followed by a Modular Port Concentrator (MPC) crash. It impacts the data traffic.
Resolved In:
junos:19.1R3-S10 junos:19.2R3-S7 junos:19.3R3-S7 junos:19.4R3-S10 junos:20.2R3-S6 junos:20.3R3-S6 junos:20.3X75-D35 junos:20.3X75-D42 junos:20.3X75-D43 junos:20.3X75-D46 junos:20.3X75-D50 junos:20.4R3-S5 junos:21.1R3-S4 junos:21.2R3-S3 junos:21.2X32-D10 junos:21.3R3-S3 junos:21.4R3 junos:22.1R2-S1 junos:22.1R3 junos:22.2R1-S2 junos:22.2R2 junos:22.3R1 junos:22.3R2 junos:22.4R1
Modification History
First publication 2023-07-09
19.3R3-S8: Software Release Notification for JUNOS Software