CVE Vulnerabilities

CVE-2021-0229

Uncontrolled Resource Consumption

Published: Apr 22, 2021 | Modified: Nov 21, 2024
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

An uncontrolled resource consumption vulnerability in Message Queue Telemetry Transport (MQTT) server of Juniper Networks Junos OS allows an attacker to cause MQTT server to crash and restart leading to a Denial of Service (DoS) by sending a stream of specific packets. A Juniper Extension Toolkit (JET) application designed with a listening port uses the Message Queue Telemetry Transport (MQTT) protocol to connect to a mosquitto broker that is running on Junos OS to subscribe for events. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS: 16.1R1 and later versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S1, 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1.

Weakness

The product does not properly control the allocation and maintenance of a limited resource.

Affected Software

Name Vendor Start Version End Version
Junos Juniper 16.1-r1 (including) 16.1-r1 (including)
Junos Juniper 16.1-r2 (including) 16.1-r2 (including)
Junos Juniper 16.1-r3 (including) 16.1-r3 (including)
Junos Juniper 16.1-r3-s10 (including) 16.1-r3-s10 (including)
Junos Juniper 16.1-r3-s11 (including) 16.1-r3-s11 (including)
Junos Juniper 16.1-r3-s8 (including) 16.1-r3-s8 (including)
Junos Juniper 16.1-r4 (including) 16.1-r4 (including)
Junos Juniper 16.1-r4-s12 (including) 16.1-r4-s12 (including)
Junos Juniper 16.1-r4-s2 (including) 16.1-r4-s2 (including)
Junos Juniper 16.1-r4-s3 (including) 16.1-r4-s3 (including)
Junos Juniper 16.1-r4-s4 (including) 16.1-r4-s4 (including)
Junos Juniper 16.1-r4-s6 (including) 16.1-r4-s6 (including)
Junos Juniper 16.1-r4-s8 (including) 16.1-r4-s8 (including)
Junos Juniper 16.1-r4-s9 (including) 16.1-r4-s9 (including)
Junos Juniper 16.1-r5 (including) 16.1-r5 (including)
Junos Juniper 16.1-r5-s4 (including) 16.1-r5-s4 (including)
Junos Juniper 16.1-r6 (including) 16.1-r6 (including)
Junos Juniper 16.1-r6-s1 (including) 16.1-r6-s1 (including)
Junos Juniper 16.1-r6-s3 (including) 16.1-r6-s3 (including)
Junos Juniper 16.1-r6-s4 (including) 16.1-r6-s4 (including)
Junos Juniper 16.1-r6-s6 (including) 16.1-r6-s6 (including)
Junos Juniper 16.1-r7 (including) 16.1-r7 (including)
Junos Juniper 16.1-r7-s2 (including) 16.1-r7-s2 (including)
Junos Juniper 16.1-r7-s3 (including) 16.1-r7-s3 (including)
Junos Juniper 16.1-r7-s4 (including) 16.1-r7-s4 (including)
Junos Juniper 16.1-r7-s5 (including) 16.1-r7-s5 (including)
Junos Juniper 16.1-r7-s6 (including) 16.1-r7-s6 (including)
Junos Juniper 16.1-r7-s7 (including) 16.1-r7-s7 (including)
Junos Juniper 16.2 (including) 16.2 (including)
Junos Juniper 16.2-r1 (including) 16.2-r1 (including)
Junos Juniper 16.2-r1-s6 (including) 16.2-r1-s6 (including)
Junos Juniper 16.2-r2 (including) 16.2-r2 (including)
Junos Juniper 16.2-r2-s1 (including) 16.2-r2-s1 (including)
Junos Juniper 16.2-r2-s10 (including) 16.2-r2-s10 (including)
Junos Juniper 16.2-r2-s2 (including) 16.2-r2-s2 (including)
Junos Juniper 16.2-r2-s5 (including) 16.2-r2-s5 (including)
Junos Juniper 16.2-r2-s6 (including) 16.2-r2-s6 (including)
Junos Juniper 16.2-r2-s7 (including) 16.2-r2-s7 (including)
Junos Juniper 16.2-r2-s8 (including) 16.2-r2-s8 (including)
Junos Juniper 16.2-r2-s9 (including) 16.2-r2-s9 (including)
Junos Juniper 16.2-r3 (including) 16.2-r3 (including)
Junos Juniper 17.1 (including) 17.1 (including)
Junos Juniper 17.1-r1 (including) 17.1-r1 (including)
Junos Juniper 17.1-r1-s7 (including) 17.1-r1-s7 (including)
Junos Juniper 17.1-r2 (including) 17.1-r2 (including)
Junos Juniper 17.1-r2-s1 (including) 17.1-r2-s1 (including)
Junos Juniper 17.1-r2-s10 (including) 17.1-r2-s10 (including)
Junos Juniper 17.1-r2-s11 (including) 17.1-r2-s11 (including)
Junos Juniper 17.1-r2-s2 (including) 17.1-r2-s2 (including)
Junos Juniper 17.1-r2-s3 (including) 17.1-r2-s3 (including)
Junos Juniper 17.1-r2-s4 (including) 17.1-r2-s4 (including)
Junos Juniper 17.1-r2-s5 (including) 17.1-r2-s5 (including)
Junos Juniper 17.1-r2-s6 (including) 17.1-r2-s6 (including)
Junos Juniper 17.1-r2-s7 (including) 17.1-r2-s7 (including)
Junos Juniper 17.1-r2-s8 (including) 17.1-r2-s8 (including)
Junos Juniper 17.1-r2-s9 (including) 17.1-r2-s9 (including)
Junos Juniper 17.1-r3 (including) 17.1-r3 (including)
Junos Juniper 17.1-r3-s1 (including) 17.1-r3-s1 (including)
Junos Juniper 17.2 (including) 17.2 (including)
Junos Juniper 17.2-r1 (including) 17.2-r1 (including)
Junos Juniper 17.2-r1-s1 (including) 17.2-r1-s1 (including)
Junos Juniper 17.2-r1-s2 (including) 17.2-r1-s2 (including)
Junos Juniper 17.2-r1-s3 (including) 17.2-r1-s3 (including)
Junos Juniper 17.2-r1-s4 (including) 17.2-r1-s4 (including)
Junos Juniper 17.2-r1-s5 (including) 17.2-r1-s5 (including)
Junos Juniper 17.2-r1-s6 (including) 17.2-r1-s6 (including)
Junos Juniper 17.2-r1-s7 (including) 17.2-r1-s7 (including)
Junos Juniper 17.2-r1-s8 (including) 17.2-r1-s8 (including)
Junos Juniper 17.2-r2 (including) 17.2-r2 (including)
Junos Juniper 17.2-r2-s11 (including) 17.2-r2-s11 (including)
Junos Juniper 17.2-r2-s4 (including) 17.2-r2-s4 (including)
Junos Juniper 17.2-r2-s6 (including) 17.2-r2-s6 (including)
Junos Juniper 17.2-r2-s7 (including) 17.2-r2-s7 (including)
Junos Juniper 17.2-r3 (including) 17.2-r3 (including)
Junos Juniper 17.2-r3-s1 (including) 17.2-r3-s1 (including)
Junos Juniper 17.2-r3-s2 (including) 17.2-r3-s2 (including)
Junos Juniper 17.2-r3-s3 (including) 17.2-r3-s3 (including)
Junos Juniper 17.3 (including) 17.3 (including)
Junos Juniper 17.3-r1 (including) 17.3-r1 (including)
Junos Juniper 17.3-r1-s1 (including) 17.3-r1-s1 (including)
Junos Juniper 17.3-r1-s4 (including) 17.3-r1-s4 (including)
Junos Juniper 17.3-r2 (including) 17.3-r2 (including)
Junos Juniper 17.3-r2-s1 (including) 17.3-r2-s1 (including)
Junos Juniper 17.3-r2-s2 (including) 17.3-r2-s2 (including)
Junos Juniper 17.3-r2-s3 (including) 17.3-r2-s3 (including)
Junos Juniper 17.3-r2-s4 (including) 17.3-r2-s4 (including)
Junos Juniper 17.3-r2-s5 (including) 17.3-r2-s5 (including)
Junos Juniper 17.3-r3 (including) 17.3-r3 (including)
Junos Juniper 17.3-r3-s1 (including) 17.3-r3-s1 (including)
Junos Juniper 17.3-r3-s10 (including) 17.3-r3-s10 (including)
Junos Juniper 17.3-r3-s2 (including) 17.3-r3-s2 (including)
Junos Juniper 17.3-r3-s3 (including) 17.3-r3-s3 (including)
Junos Juniper 17.3-r3-s4 (including) 17.3-r3-s4 (including)
Junos Juniper 17.3-r3-s5 (including) 17.3-r3-s5 (including)
Junos Juniper 17.3-r3-s6 (including) 17.3-r3-s6 (including)
Junos Juniper 17.3-r3-s7 (including) 17.3-r3-s7 (including)
Junos Juniper 17.3-r3-s8 (including) 17.3-r3-s8 (including)
Junos Juniper 17.3-r3-s9 (including) 17.3-r3-s9 (including)
Junos Juniper 17.4 (including) 17.4 (including)
Junos Juniper 17.4-r1 (including) 17.4-r1 (including)
Junos Juniper 17.4-r1-s1 (including) 17.4-r1-s1 (including)
Junos Juniper 17.4-r1-s2 (including) 17.4-r1-s2 (including)
Junos Juniper 17.4-r1-s3 (including) 17.4-r1-s3 (including)
Junos Juniper 17.4-r1-s4 (including) 17.4-r1-s4 (including)
Junos Juniper 17.4-r1-s5 (including) 17.4-r1-s5 (including)
Junos Juniper 17.4-r1-s6 (including) 17.4-r1-s6 (including)
Junos Juniper 17.4-r1-s7 (including) 17.4-r1-s7 (including)
Junos Juniper 17.4-r2 (including) 17.4-r2 (including)
Junos Juniper 17.4-r2-s1 (including) 17.4-r2-s1 (including)
Junos Juniper 17.4-r2-s10 (including) 17.4-r2-s10 (including)
Junos Juniper 17.4-r2-s11 (including) 17.4-r2-s11 (including)
Junos Juniper 17.4-r2-s12 (including) 17.4-r2-s12 (including)
Junos Juniper 17.4-r2-s2 (including) 17.4-r2-s2 (including)
Junos Juniper 17.4-r2-s3 (including) 17.4-r2-s3 (including)
Junos Juniper 17.4-r2-s4 (including) 17.4-r2-s4 (including)
Junos Juniper 17.4-r2-s5 (including) 17.4-r2-s5 (including)
Junos Juniper 17.4-r2-s6 (including) 17.4-r2-s6 (including)
Junos Juniper 17.4-r2-s7 (including) 17.4-r2-s7 (including)
Junos Juniper 17.4-r2-s8 (including) 17.4-r2-s8 (including)
Junos Juniper 17.4-r2-s9 (including) 17.4-r2-s9 (including)
Junos Juniper 17.4-r3 (including) 17.4-r3 (including)
Junos Juniper 17.4-r3-s1 (including) 17.4-r3-s1 (including)
Junos Juniper 17.4-r3-s2 (including) 17.4-r3-s2 (including)
Junos Juniper 17.4-r3-s3 (including) 17.4-r3-s3 (including)
Junos Juniper 18.1 (including) 18.1 (including)
Junos Juniper 18.1-r1 (including) 18.1-r1 (including)
Junos Juniper 18.1-r2 (including) 18.1-r2 (including)
Junos Juniper 18.1-r2-s1 (including) 18.1-r2-s1 (including)
Junos Juniper 18.1-r2-s2 (including) 18.1-r2-s2 (including)
Junos Juniper 18.1-r2-s4 (including) 18.1-r2-s4 (including)
Junos Juniper 18.1-r3 (including) 18.1-r3 (including)
Junos Juniper 18.1-r3-s1 (including) 18.1-r3-s1 (including)
Junos Juniper 18.1-r3-s10 (including) 18.1-r3-s10 (including)
Junos Juniper 18.1-r3-s11 (including) 18.1-r3-s11 (including)
Junos Juniper 18.1-r3-s2 (including) 18.1-r3-s2 (including)
Junos Juniper 18.1-r3-s3 (including) 18.1-r3-s3 (including)
Junos Juniper 18.1-r3-s4 (including) 18.1-r3-s4 (including)
Junos Juniper 18.1-r3-s5 (including) 18.1-r3-s5 (including)
Junos Juniper 18.1-r3-s6 (including) 18.1-r3-s6 (including)
Junos Juniper 18.1-r3-s7 (including) 18.1-r3-s7 (including)
Junos Juniper 18.1-r3-s8 (including) 18.1-r3-s8 (including)
Junos Juniper 18.1-r3-s9 (including) 18.1-r3-s9 (including)
Junos Juniper 18.2 (including) 18.2 (including)
Junos Juniper 18.2-r1 (including) 18.2-r1 (including)
Junos Juniper 18.2-r1-s2 (including) 18.2-r1-s2 (including)
Junos Juniper 18.2-r1-s3 (including) 18.2-r1-s3 (including)
Junos Juniper 18.2-r1-s4 (including) 18.2-r1-s4 (including)
Junos Juniper 18.2-r1-s5 (including) 18.2-r1-s5 (including)
Junos Juniper 18.2-r2 (including) 18.2-r2 (including)
Junos Juniper 18.2-r2-s1 (including) 18.2-r2-s1 (including)
Junos Juniper 18.2-r2-s2 (including) 18.2-r2-s2 (including)
Junos Juniper 18.2-r2-s3 (including) 18.2-r2-s3 (including)
Junos Juniper 18.2-r2-s4 (including) 18.2-r2-s4 (including)
Junos Juniper 18.2-r2-s5 (including) 18.2-r2-s5 (including)
Junos Juniper 18.2-r2-s6 (including) 18.2-r2-s6 (including)
Junos Juniper 18.2-r2-s7 (including) 18.2-r2-s7 (including)
Junos Juniper 18.2-r3 (including) 18.2-r3 (including)
Junos Juniper 18.2-r3-s1 (including) 18.2-r3-s1 (including)
Junos Juniper 18.2-r3-s2 (including) 18.2-r3-s2 (including)
Junos Juniper 18.2-r3-s3 (including) 18.2-r3-s3 (including)
Junos Juniper 18.2-r3-s4 (including) 18.2-r3-s4 (including)
Junos Juniper 18.2-r3-s5 (including) 18.2-r3-s5 (including)
Junos Juniper 18.2-r3-s6 (including) 18.2-r3-s6 (including)
Junos Juniper 18.3 (including) 18.3 (including)
Junos Juniper 18.3-r1 (including) 18.3-r1 (including)
Junos Juniper 18.3-r1-s1 (including) 18.3-r1-s1 (including)
Junos Juniper 18.3-r1-s2 (including) 18.3-r1-s2 (including)
Junos Juniper 18.3-r1-s3 (including) 18.3-r1-s3 (including)
Junos Juniper 18.3-r1-s4 (including) 18.3-r1-s4 (including)
Junos Juniper 18.3-r1-s5 (including) 18.3-r1-s5 (including)
Junos Juniper 18.3-r1-s6 (including) 18.3-r1-s6 (including)
Junos Juniper 18.3-r2 (including) 18.3-r2 (including)
Junos Juniper 18.3-r2-s1 (including) 18.3-r2-s1 (including)
Junos Juniper 18.3-r2-s2 (including) 18.3-r2-s2 (including)
Junos Juniper 18.3-r2-s3 (including) 18.3-r2-s3 (including)
Junos Juniper 18.3-r2-s4 (including) 18.3-r2-s4 (including)
Junos Juniper 18.3-r3 (including) 18.3-r3 (including)
Junos Juniper 18.3-r3-s1 (including) 18.3-r3-s1 (including)
Junos Juniper 18.3-r3-s2 (including) 18.3-r3-s2 (including)
Junos Juniper 18.3-r3-s3 (including) 18.3-r3-s3 (including)
Junos Juniper 18.4 (including) 18.4 (including)
Junos Juniper 18.4-r1 (including) 18.4-r1 (including)
Junos Juniper 18.4-r1-s1 (including) 18.4-r1-s1 (including)
Junos Juniper 18.4-r1-s2 (including) 18.4-r1-s2 (including)
Junos Juniper 18.4-r1-s3 (including) 18.4-r1-s3 (including)
Junos Juniper 18.4-r1-s4 (including) 18.4-r1-s4 (including)
Junos Juniper 18.4-r1-s5 (including) 18.4-r1-s5 (including)
Junos Juniper 18.4-r1-s6 (including) 18.4-r1-s6 (including)
Junos Juniper 18.4-r1-s7 (including) 18.4-r1-s7 (including)
Junos Juniper 18.4-r2 (including) 18.4-r2 (including)
Junos Juniper 18.4-r2-s1 (including) 18.4-r2-s1 (including)
Junos Juniper 18.4-r2-s2 (including) 18.4-r2-s2 (including)
Junos Juniper 18.4-r2-s3 (including) 18.4-r2-s3 (including)
Junos Juniper 18.4-r2-s4 (including) 18.4-r2-s4 (including)
Junos Juniper 18.4-r2-s5 (including) 18.4-r2-s5 (including)
Junos Juniper 18.4-r2-s6 (including) 18.4-r2-s6 (including)
Junos Juniper 18.4-r3 (including) 18.4-r3 (including)
Junos Juniper 18.4-r3-s1 (including) 18.4-r3-s1 (including)
Junos Juniper 18.4-r3-s2 (including) 18.4-r3-s2 (including)
Junos Juniper 18.4-r3-s3 (including) 18.4-r3-s3 (including)
Junos Juniper 18.4-r3-s4 (including) 18.4-r3-s4 (including)
Junos Juniper 18.4-r3-s5 (including) 18.4-r3-s5 (including)
Junos Juniper 18.4-r3-s6 (including) 18.4-r3-s6 (including)
Junos Juniper 19.1 (including) 19.1 (including)
Junos Juniper 19.1-r1 (including) 19.1-r1 (including)
Junos Juniper 19.1-r1-s1 (including) 19.1-r1-s1 (including)
Junos Juniper 19.1-r1-s2 (including) 19.1-r1-s2 (including)
Junos Juniper 19.1-r1-s3 (including) 19.1-r1-s3 (including)
Junos Juniper 19.1-r1-s4 (including) 19.1-r1-s4 (including)
Junos Juniper 19.1-r1-s5 (including) 19.1-r1-s5 (including)
Junos Juniper 19.1-r2 (including) 19.1-r2 (including)
Junos Juniper 19.1-r2-s1 (including) 19.1-r2-s1 (including)
Junos Juniper 19.1-r3 (including) 19.1-r3 (including)
Junos Juniper 19.1-r3-s1 (including) 19.1-r3-s1 (including)
Junos Juniper 19.1-r3-s2 (including) 19.1-r3-s2 (including)
Junos Juniper 19.1-r3-s3 (including) 19.1-r3-s3 (including)
Junos Juniper 19.1-r3-s4 (including) 19.1-r3-s4 (including)
Junos Juniper 19.2 (including) 19.2 (including)
Junos Juniper 19.2-r1 (including) 19.2-r1 (including)
Junos Juniper 19.2-r1-s1 (including) 19.2-r1-s1 (including)
Junos Juniper 19.2-r1-s2 (including) 19.2-r1-s2 (including)
Junos Juniper 19.2-r1-s3 (including) 19.2-r1-s3 (including)
Junos Juniper 19.2-r1-s4 (including) 19.2-r1-s4 (including)
Junos Juniper 19.2-r1-s5 (including) 19.2-r1-s5 (including)
Junos Juniper 19.2-r2 (including) 19.2-r2 (including)
Junos Juniper 19.2-r2-s1 (including) 19.2-r2-s1 (including)
Junos Juniper 19.2-r3 (including) 19.2-r3 (including)
Junos Juniper 19.2-r3-s1 (including) 19.2-r3-s1 (including)
Junos Juniper 19.3 (including) 19.3 (including)
Junos Juniper 19.3-r1 (including) 19.3-r1 (including)
Junos Juniper 19.3-r1-s1 (including) 19.3-r1-s1 (including)
Junos Juniper 19.3-r2 (including) 19.3-r2 (including)
Junos Juniper 19.3-r2-s1 (including) 19.3-r2-s1 (including)
Junos Juniper 19.3-r2-s2 (including) 19.3-r2-s2 (including)
Junos Juniper 19.3-r2-s3 (including) 19.3-r2-s3 (including)
Junos Juniper 19.3-r2-s4 (including) 19.3-r2-s4 (including)
Junos Juniper 19.3-r2-s5 (including) 19.3-r2-s5 (including)
Junos Juniper 19.3-r3 (including) 19.3-r3 (including)
Junos Juniper 19.4-r1 (including) 19.4-r1 (including)
Junos Juniper 19.4-r1-s1 (including) 19.4-r1-s1 (including)
Junos Juniper 19.4-r1-s2 (including) 19.4-r1-s2 (including)
Junos Juniper 19.4-r2 (including) 19.4-r2 (including)
Junos Juniper 19.4-r2-s1 (including) 19.4-r2-s1 (including)
Junos Juniper 19.4-r2-s2 (including) 19.4-r2-s2 (including)
Junos Juniper 19.4-r2-s3 (including) 19.4-r2-s3 (including)
Junos Juniper 19.4-r3 (including) 19.4-r3 (including)
Junos Juniper 19.4-r3-s1 (including) 19.4-r3-s1 (including)
Junos Juniper 20.1-r1 (including) 20.1-r1 (including)
Junos Juniper 20.1-r1-s1 (including) 20.1-r1-s1 (including)
Junos Juniper 20.1-r1-s2 (including) 20.1-r1-s2 (including)
Junos Juniper 20.1-r1-s3 (including) 20.1-r1-s3 (including)
Junos Juniper 20.1-r1-s4 (including) 20.1-r1-s4 (including)
Junos Juniper 20.2-r1 (including) 20.2-r1 (including)
Junos Juniper 20.2-r1-s1 (including) 20.2-r1-s1 (including)
Junos Juniper 20.2-r1-s2 (including) 20.2-r1-s2 (including)
Junos Juniper 20.2-r2 (including) 20.2-r2 (including)
Junos Juniper 20.2-r2-s1 (including) 20.2-r2-s1 (including)
Junos Juniper 20.3-r1 (including) 20.3-r1 (including)

Potential Mitigations

  • Mitigation of resource exhaustion attacks requires that the target system either:

  • The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.

  • The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

References