CVE-2019-18948
First published: Thu Apr 16 2020(Updated: )
An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M and below releases in the 4.22.x train, 4.23.1F and below releases in the 4.23.x train, and all releases in 4.15, 4.16, 4.17, 4.18, 4.19, 4.20 code train.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arista EOS | >=4.21.0<=4.21.8m | |
| Arista EOS | >=4.22.0<=4.22.3m | |
| Arista EOS | >=4.23.0<=4.23.1f | |
| Arista EOS | =4.15 | |
| Arista EOS | =4.16 | |
| Arista EOS | =4.17 | |
| Arista EOS | =4.18 | |
| Arista EOS | =4.19 | |
| Arista EOS | =4.20 |
Remedy
https://www.arista.com/en/support/advisories-notices/security-advisories/10292-security-advisory-47
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-18948.
What is the severity of CVE-2019-18948?
The severity of CVE-2019-18948 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-18948?
CVE-2019-18948 affects Arista EOS versions 4.21.8M and below in the 4.21.x train, 4.22.3M and below in the 4.22.x train, and 4.23.1f and below in the 4.23.x train.
What is the impact of CVE-2019-18948?
CVE-2019-18948 allows attackers to crash the VxlanSwFwd agent by sending specific malformed ARP packets, impacting the software forwarding of VxLAN packets.
How can I fix CVE-2019-18948?
To fix CVE-2019-18948, it is recommended to update to a version of Arista EOS that is not affected by this vulnerability.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/arista
- canonical/arista eos
- version/arista eos/4.21.0
- version/arista eos/4.21.8m
- version/arista eos/4.22.0
- version/arista eos/4.22.3m
- version/arista eos/4.23.0
- version/arista eos/4.23.1f
- version/arista eos/4.15
- version/arista eos/4.16
- version/arista eos/4.17
- version/arista eos/4.18
- version/arista eos/4.19
- version/arista eos/4.20