Follow us
You can contact the Cybersecurity Council directly for your inquiries.
Join the CSC in protecting the UAE’s national security and strategic achievements.
Follow our channels on social media.
- published 1/21/25 10:07 AM •
- updated 14 January 2025 •
- 3 Min Read
Security Updates – Juniper Junos OS
Alert Rating
Audience
Corporations, Government
On this page
Security Updates – Juniper Junos OS
Vulnerability Details:
1. CVE-2025-21598: Out-of-Bounds Read in Routing Protocol Daemon (RPD)
- Affected Systems: Junos OS versions 21.2R3-S8 through 24.2R1 and corresponding versions of Junos OS Evolved.
- Description: This vulnerability occurs in the routing protocol daemon (RPD) and allows unauthenticated attackers to send malformed Border Gateway Protocol (BGP) packets, causing RPD to crash. The attack can spread across multiple Autonomous Systems (ASes), potentially impacting interconnected networks. Devices with BGP trace options enabled are especially vulnerable.
2. CVE-2025-21599: Memory Exhaustion in Juniper Tunnel Driver (jtd)
- Affected Systems: from 22.4-EVO before 22.4R3-S5-EVO
- from 23.2-EVO before 23.2R2-S2-EVO
- from 23.4-EVO before 23.4R2-S2-EVO
- from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO
- Fixed Version:
- Junos OS Evolved: 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S2-EVO, 24.2R1-S2-EVO, 24.2R2-EVO, 24.4R1-EVO, and all subsequent releases.
- Description: A memory exhaustion vulnerability exists in the Juniper Tunnel Driver (jtd) where specially crafted IPv6 packets can cause kernel memory exhaustion. This leads to a Denial of Service (DoS) condition as continuous receipt of malicious packets depletes available system memory, causing the system to crash.
Take Action
Protect yourself
The UAE Cyber Security Council recommends to upgrade the affected versions to the fixed versions at the earliest.
Stay Connected
Follow our channels
Take Action
Spread Awareness
Share this threat to raise awareness and help others stay alert
GET INVOLVED
Make a Difference
Other Threats
20 January 2025
Critical Vulnerability in F5 Traffix SDC
A critical vulnerability has been discovered in F5 Traffix SDC, linked to Apache Tomcat, which could allow attackers to gain unauthorized access to compromised systems.
Protecting
Corporations, Government
Share in:
17 January 2025
NVIDIA has released security updates to address multiple vulnerabilities in the NVIDIA Container Toolkit and NVIDIA GPU Operator.
Protecting
Corporations, Government
Share in:
16 January 2025
Critical Vulnerability in FortiSwitch Devices
A critical vulnerability (CVE-2023-37936) has been discovered in multiple versions of Fortinet FortiSwitch devices. This vulnerability, classified as a use of hard-coded cryptographic key [CWE-321], allows a remote unauthenticated attacker in possession of the key to execute unauthorized code via crafted cryptographic request.
Protecting
Corporations, Government
Share in:
