7.1

CVE-2019-0073

Junos OS: PKI key pairs are exported with insecure file permissions

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version 15.1x49 Update -
Juniper ≫ Junos Version 15.1x49 Update d10
Juniper ≫ Junos Version 15.1x49 Update d100
Juniper ≫ Junos Version 15.1x49 Update d110
Juniper ≫ Junos Version 15.1x49 Update d120
Juniper ≫ Junos Version 15.1x49 Update d130
Juniper ≫ Junos Version 15.1x49 Update d140
Juniper ≫ Junos Version 15.1x49 Update d150
Juniper ≫ Junos Version 15.1x49 Update d160
Juniper ≫ Junos Version 15.1x49 Update d170
Juniper ≫ Junos Version 15.1x49 Update d20
Juniper ≫ Junos Version 15.1x49 Update d30
Juniper ≫ Junos Version 15.1x49 Update d35
Juniper ≫ Junos Version 15.1x49 Update d40
Juniper ≫ Junos Version 15.1x49 Update d45
Juniper ≫ Junos Version 15.1x49 Update d50
Juniper ≫ Junos Version 15.1x49 Update d55
Juniper ≫ Junos Version 15.1x49 Update d60
Juniper ≫ Junos Version 15.1x49 Update d65
Juniper ≫ Junos Version 15.1x49 Update d70
Juniper ≫ Junos Version 15.1x49 Update d75
Juniper ≫ Junos Version 15.1x49 Update d80
Juniper ≫ Junos Version 15.1x49 Update d90
Juniper ≫ Junos Version 17.3 Update -
Juniper ≫ Junos Version 17.3 Update r1
Juniper ≫ Junos Version 17.3 Update r2
Juniper ≫ Junos Version 17.3 Update r2-s1
Juniper ≫ Junos Version 17.3 Update r2-s2
Juniper ≫ Junos Version 17.3 Update r3
Juniper ≫ Junos Version 17.3 Update r3-s1
Juniper ≫ Junos Version 17.3 Update r3-s2
Juniper ≫ Junos Version 17.3 Update r3-s3
Juniper ≫ Junos Version 17.3 Update r3-s4
Juniper ≫ Junos Version 17.3 Update r3-s5
Juniper ≫ Junos Version 17.3 Update r3-s6
Juniper ≫ Junos Version 17.4 Update -
Juniper ≫ Junos Version 17.4 Update r1
Juniper ≫ Junos Version 17.4 Update r1-s1
Juniper ≫ Junos Version 17.4 Update r1-s2
Juniper ≫ Junos Version 17.4 Update r1-s4
Juniper ≫ Junos Version 17.4 Update r1-s6
Juniper ≫ Junos Version 17.4 Update r1-s7
Juniper ≫ Junos Version 17.4 Update r2
Juniper ≫ Junos Version 17.4 Update r2-s1
Juniper ≫ Junos Version 17.4 Update r2-s3
Juniper ≫ Junos Version 17.4 Update r2-s4
Juniper ≫ Junos Version 17.4 Update r2-s5
Juniper ≫ Junos Version 17.4 Update r2-s6
Juniper ≫ Junos Version 17.4 Update r2-s7
Juniper ≫ Junos Version 18.1 Update -
Juniper ≫ Junos Version 18.1 Update r2
Juniper ≫ Junos Version 18.1 Update r2-s1
Juniper ≫ Junos Version 18.1 Update r2-s2
Juniper ≫ Junos Version 18.1 Update r2-s4
Juniper ≫ Junos Version 18.1 Update r3
Juniper ≫ Junos Version 18.1 Update r3-s2
Juniper ≫ Junos Version 18.1 Update r3-s3
Juniper ≫ Junos Version 18.1 Update r3-s4
Juniper ≫ Junos Version 18.1 Update r3-s5
Juniper ≫ Junos Version 18.1 Update r3-s6
Juniper ≫ Junos Version 18.1 Update r3-s7
Juniper ≫ Junos Version 18.2 Update -
Juniper ≫ Junos Version 18.2 Update r1-s5
Juniper ≫ Junos Version 18.2 Update r2
Juniper ≫ Junos Version 18.2 Update r2-s1
Juniper ≫ Junos Version 18.2 Update r2-s2
Juniper ≫ Junos Version 18.2 Update r2-s3
Juniper ≫ Junos Version 18.2 Update r2-s4
Juniper ≫ Junos Version 18.3 Update -
Juniper ≫ Junos Version 18.3 Update r1
Juniper ≫ Junos Version 18.3 Update r1-s1
Juniper ≫ Junos Version 18.3 Update r1-s2
Juniper ≫ Junos Version 18.3 Update r1-s3
Juniper ≫ Junos Version 18.4 Update -
Juniper ≫ Junos Version 18.4 Update r1
Juniper ≫ Junos Version 18.4 Update r1-s2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.201
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
Juniper 6.6 1.3 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://kb.juniper.net/JSA10974
Vendor Advisory