cve-2019-14810
Vulnerability from cvelistv5
Published
2019-10-10 18:07
Modified
2024-08-05 00:26
Severity ?
EPSS score ?
Summary
A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T00:26:39.049Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.arista.com/en/support/advisories-notices" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)" } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-10-10T18:07:51", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://www.arista.com/en/support/advisories-notices" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-14810", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.arista.com/en/support/advisories-notices", "refsource": "MISC", "url": "https://www.arista.com/en/support/advisories-notices" }, { "name": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42", "refsource": "CONFIRM", "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-14810", "datePublished": "2019-10-10T18:07:51", "dateReserved": "2019-08-10T00:00:00", "dateUpdated": "2024-08-05T00:26:39.049Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "fkie_nvd": { "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19\", \"versionEndIncluding\": \"4.19.12m\", \"matchCriteriaId\": \"CF0622F4-B19E-4D53-A0AF-481F0D65AA87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndIncluding\": \"4.20.14m\", \"matchCriteriaId\": \"A1A9BBA3-708A-4F20-A9C1-54B1368D1BA8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.21.0f\", \"versionEndIncluding\": \"4.21.2.3f\", \"matchCriteriaId\": \"1F31FBFC-C81E-4BC1-AC4E-FBD0F0CD00B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.21.3f\", \"versionEndIncluding\": \"4.21.7\", \"matchCriteriaId\": \"49F87620-E066-4250-9745-A8B842612AFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:4.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7DB48708-D409-4379-9F2C-170F3A1B53BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:4.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2C0823B5-1F76-4712-A17A-C43DCAA189DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:extensible_operating_system:4.22.1f:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A96FAAFE-DB6E-40CA-A0FF-C9C76C8DF1C6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7020r:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A3371EEF-9D7A-4EF6-A435-A0F1034E5EE7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7280e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6466FE3-DCE8-4DA5-B893-2BA864F73BC5\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7280r:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C02B50F5-B316-4081-BC9E-6F1778049096\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7280r2:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"21CB1AAF-FC82-4A80-9932-42E8EFA3906A\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7280r3:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60FC964C-9835-443A-A584-3A5D6022E914\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7500e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"06C61DCC-D1CF-4CE5-9634-4BE3E071E83E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7500r:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC651584-113E-4859-9F14-12D62F3BD626\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7500r2:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"583725F6-8583-425C-A847-700DBB9169E7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:arista:7500r3:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6A4B3C-FF12-4DCD-9945-8450AD0BDEED\"}]}]}]", "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)\"}, {\"lang\": \"es\", \"value\": \"Se ha encontrado una vulnerabilidad en la implementaci\\u00f3n del protocolo Label Distribution Protocol (LDP) en EOS. En condiciones de carrera, el agente de LDP puede establecer una sesi\\u00f3n de LDP con un peer malicioso, permitiendo potencialmente la posibilidad de un ataque de Denegaci\\u00f3n de Servicio (DoS) sobre las actualizaciones de ruta y, a su vez, conllevando potencialmente a una condici\\u00f3n Out of Memory (OOM) que es perjudicial para el reenv\\u00edo de tr\\u00e1fico. Las versiones EOS afectadas incluyen: tren de publicaciones de 4.22: 4.22.1F y versiones anteriores; tren de publicaciones de 4.21: 4.21.0F hasta 4.21.2.3F, 4.21.3F hasta 4.21.7.1M; tren de publicaciones de 4.20: 4.20.14M y versiones anteriores; tren de publicaciones de 4.19: 4.19.12M y versiones anteriores; trenes de publicaciones de fin de soporte (4.18 y 4.17)\"}]", "id": "CVE-2019-14810", "lastModified": "2024-11-21T04:27:24.337", "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", "published": "2019-10-10T19:15:10.950", "references": "[{\"url\": \"https://www.arista.com/en/support/advisories-notices\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.arista.com/en/support/advisories-notices\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]", "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]" }, "nvd": "{\"cve\":{\"id\":\"CVE-2019-14810\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-10-10T19:15:10.950\",\"lastModified\":\"2024-11-21T04:27:24.337\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado una vulnerabilidad en la implementaci\u00f3n del protocolo Label Distribution Protocol (LDP) en EOS. En condiciones de carrera, el agente de LDP puede establecer una sesi\u00f3n de LDP con un peer malicioso, permitiendo potencialmente la posibilidad de un ataque de Denegaci\u00f3n de Servicio (DoS) sobre las actualizaciones de ruta y, a su vez, conllevando potencialmente a una condici\u00f3n Out of Memory (OOM) que es perjudicial para el reenv\u00edo de tr\u00e1fico. Las versiones EOS afectadas incluyen: tren de publicaciones de 4.22: 4.22.1F y versiones anteriores; tren de publicaciones de 4.21: 4.21.0F hasta 4.21.2.3F, 4.21.3F hasta 4.21.7.1M; tren de publicaciones de 4.20: 4.20.14M y versiones anteriores; tren de publicaciones de 4.19: 4.19.12M y versiones anteriores; trenes de publicaciones de fin de soporte (4.18 y 4.17)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndIncluding\":\"4.19.12m\",\"matchCriteriaId\":\"CF0622F4-B19E-4D53-A0AF-481F0D65AA87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndIncluding\":\"4.20.14m\",\"matchCriteriaId\":\"A1A9BBA3-708A-4F20-A9C1-54B1368D1BA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.21.0f\",\"versionEndIncluding\":\"4.21.2.3f\",\"matchCriteriaId\":\"1F31FBFC-C81E-4BC1-AC4E-FBD0F0CD00B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.21.3f\",\"versionEndIncluding\":\"4.21.7\",\"matchCriteriaId\":\"49F87620-E066-4250-9745-A8B842612AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:4.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DB48708-D409-4379-9F2C-170F3A1B53BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:4.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C0823B5-1F76-4712-A17A-C43DCAA189DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:extensible_operating_system:4.22.1f:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A96FAAFE-DB6E-40CA-A0FF-C9C76C8DF1C6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7020r:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3371EEF-9D7A-4EF6-A435-A0F1034E5EE7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7280e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6466FE3-DCE8-4DA5-B893-2BA864F73BC5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7280r:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C02B50F5-B316-4081-BC9E-6F1778049096\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7280r2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"21CB1AAF-FC82-4A80-9932-42E8EFA3906A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7280r3:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60FC964C-9835-443A-A584-3A5D6022E914\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7500e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06C61DCC-D1CF-4CE5-9634-4BE3E071E83E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7500r:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC651584-113E-4859-9F14-12D62F3BD626\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7500r2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"583725F6-8583-425C-A847-700DBB9169E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:arista:7500r3:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6A4B3C-FF12-4DCD-9945-8450AD0BDEED\"}]}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.arista.com/en/support/advisories-notices\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.