CVE-2019-18948: High severity arista eos vulnerability

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-18948.

Q: What is the severity of CVE-2019-18948?

The severity of CVE-2019-18948 is high with a CVSS score of 7.5.

Q: Which software versions are affected by CVE-2019-18948?

CVE-2019-18948 affects Arista EOS versions 4.21.8M and below in the 4.21.x train, 4.22.3M and below in the 4.22.x train, and 4.23.1f and below in the 4.23.x train.

Q: What is the impact of CVE-2019-18948?

CVE-2019-18948 allows attackers to crash the VxlanSwFwd agent by sending specific malformed ARP packets, impacting the software forwarding of VxLAN packets.

Q: How can I fix CVE-2019-18948?

To fix CVE-2019-18948, it is recommended to update to a version of Arista EOS that is not affected by this vulnerability.

Published Apr 16, 2020

Updated

An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M and below releases in the 4.22.x train, 4.23.1F and below releases in the 4.23.x train, and all releases in 4.15, 4.16, 4.17, 4.18, 4.19, 4.20 code train.

Affected Software

9 affected components

Arista EOS>=4.21.0<=4.21.8m

Arista EOS>=4.22.0<=4.22.3m

Arista EOS>=4.23.0<=4.23.1f

Arista EOS=4.15

Arista EOS=4.16

Arista EOS=4.17

Arista EOS=4.18

Arista EOS=4.19

Arista EOS=4.20

Remediation

Patch Available

https://www.arista.com/en/support/advisories-notices/security-advisories/10292-security-advisory-47

Event History

Apr 16, 2020

CVE Published

via MITRE·04:52 PM

Data Sourced

via MITRE·04:52 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-18948.

What is the severity of CVE-2019-18948?