Security patches for critical flaws in the Junos Operating System and Contrail Networking have been posted by Juniper

Juniper Networks has distributed security patches to address a number of vulnerabilities that affect a variety of devices. Some of these vulnerabilities might be exploited by malicious actors to take control of the systems that are impacted.

The vulnerabilities that impact Junos Space and Contrail Networking are categorized as severe, and the company that makes these products recommends that users update to versions 22.1R1 and 21.4.0, respectively, as soon as possible.

The Junos Space network management software has a total of 31 flaws, the most serious of which is CVE-2021-23017 (CVSS score: 9.4), which might cause affected devices to crash or potentially enable arbitrary code execution on them.

“A security problem in nginx resolver was detected”, the company warned in a statement. According to the information that has been revealed, this may enable an attacker who is able to spoof UDP packets from the DNS server to cause 1-byte memory to overwrite, which would result in a worker process crash or possible additional consequences.

Northstar Controller, in its versions 5.1.0 Service Pack 6 and 6.2.2, has also been patched to address the same security flaw.

In addition, the networking equipment manufacturer warned that CentOS 6.8, which was packaged with Junos Space Policy Enforcer prior to version 22.1R1, had many bugs already known to exist. As a preventative measure, the Policy Enforcer component of CentOS has been updated to version 7.9 since the vulnerability was discovered.

Also included on the list are 166 security flaws that affect the company’s Contrail Networking product. These flaws are present in all versions of the software that were released before 21.4.0 and have been assigned a CVSS score of 10.0 as a group.

It was noted in an advisory that upgrading the Open Container Initiative (OCI)-compliant Red Hat Universal Base Image (UBI) container image from Red Hat Enterprise Linux 7 to Red Hat Enterprise Linux 8 resolved multiple vulnerabilities in third-party software used in Juniper Networks Contrail Networking.