9.8

CVE-2020-1647

Junos OS: SRX Series: Double free vulnerability can lead to DoS or remote code execution due to the processing of a specific HTTP message when ICAP redirect service is enabled

On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, a double free vulnerability can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) due to processing of a specific HTTP message. Continued processing of this specific HTTP message may result in an extended Denial of Service (DoS). The offending HTTP message that causes this issue may originate both from the HTTP server or the client. This issue affects Juniper Networks Junos OS on SRX Series: 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S3; 18.3 versions prior to 18.3R2-S4, 18.3R3-S1; 18.4 versions prior to 18.4R2-S5, 18.4R3; 19.1 versions prior to 19.1R2; 19.2 versions prior to 19.2R1-S2, 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version 18.1 Update -
Juniper ≫ Junos Version 18.1 Update r1
Juniper ≫ Junos Version 18.1 Update r2
Juniper ≫ Junos Version 18.1 Update r2-s1
Juniper ≫ Junos Version 18.1 Update r2-s2
Juniper ≫ Junos Version 18.1 Update r2-s4
Juniper ≫ Junos Version 18.1 Update r3
Juniper ≫ Junos Version 18.1 Update r3-s1
Juniper ≫ Junos Version 18.1 Update r3-s2
Juniper ≫ Junos Version 18.1 Update r3-s3
Juniper ≫ Junos Version 18.1 Update r3-s4
Juniper ≫ Junos Version 18.1 Update r3-s6
Juniper ≫ Junos Version 18.1 Update r3-s7
Juniper ≫ Junos Version 18.1 Update r3-s8
Juniper ≫ Junos Version 18.2 Update -
Juniper ≫ Junos Version 18.2 Update r1
Juniper ≫ Junos Version 18.2 Update r1 Edition -
Juniper ≫ Junos Version 18.2 Update r1-s3
Juniper ≫ Junos Version 18.2 Update r1-s4
Juniper ≫ Junos Version 18.2 Update r1-s5
Juniper ≫ Junos Version 18.2 Update r2
Juniper ≫ Junos Version 18.2 Update r2-s1
Juniper ≫ Junos Version 18.2 Update r2-s2
Juniper ≫ Junos Version 18.2 Update r2-s3
Juniper ≫ Junos Version 18.2 Update r2-s4
Juniper ≫ Junos Version 18.2 Update r2-s5
Juniper ≫ Junos Version 18.2 Update r2-s6
Juniper ≫ Junos Version 18.2 Update r3
Juniper ≫ Junos Version 18.2 Update r3-s1
Juniper ≫ Junos Version 18.2 Update r3-s2
Juniper ≫ Junos Version 18.3 Update -
Juniper ≫ Junos Version 18.3 Update r1
Juniper ≫ Junos Version 18.3 Update r1-s1
Juniper ≫ Junos Version 18.3 Update r1-s2
Juniper ≫ Junos Version 18.3 Update r1-s3
Juniper ≫ Junos Version 18.3 Update r1-s5
Juniper ≫ Junos Version 18.3 Update r1-s6
Juniper ≫ Junos Version 18.3 Update r2
Juniper ≫ Junos Version 18.3 Update r2-s1
Juniper ≫ Junos Version 18.3 Update r2-s2
Juniper ≫ Junos Version 18.3 Update r2-s3
Juniper ≫ Junos Version 18.3 Update r3
Juniper ≫ Junos Version 18.4 Update -
Juniper ≫ Junos Version 18.4 Update r1
Juniper ≫ Junos Version 18.4 Update r1-s1
Juniper ≫ Junos Version 18.4 Update r1-s2
Juniper ≫ Junos Version 18.4 Update r1-s5
Juniper ≫ Junos Version 18.4 Update r1-s6
Juniper ≫ Junos Version 18.4 Update r2
Juniper ≫ Junos Version 18.4 Update r2-s1
Juniper ≫ Junos Version 18.4 Update r2-s2
Juniper ≫ Junos Version 18.4 Update r2-s3
Juniper ≫ Junos Version 18.4 Update r2-s4
Juniper ≫ Junos Version 19.1 Update -
Juniper ≫ Junos Version 19.1 Update r1
Juniper ≫ Junos Version 19.1 Update r1-s1
Juniper ≫ Junos Version 19.1 Update r1-s2
Juniper ≫ Junos Version 19.1 Update r1-s3
Juniper ≫ Junos Version 19.1 Update r1-s4
Juniper ≫ Junos Version 19.2 Update -
Juniper ≫ Junos Version 19.2 Update r1
Juniper ≫ Junos Version 19.2 Update r1-s1
Juniper ≫ Junos Version 19.3 Update -
Juniper ≫ Junos Version 19.3 Update r1
Juniper ≫ Junos Version 19.3 Update r1-s1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.65% 0.836
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Juniper 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://kb.juniper.net/JSA11034
Vendor Advisory