CVE-2020-1620: Junos OS Evolved: Configd leaks hashes via log file and is world readable
A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Evolved prior to 19.3R1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 19.3R1-EVO
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1620?
CVE-2020-1620 has a medium severity rating of 5.5 according to CVSS 3.1.
How do I fix CVE-2020-1620?
To fix CVE-2020-1620, upgrade to Junos OS Evolved version 19.3R1-EVO or any subsequent releases.
What are the main risks associated with CVE-2020-1620?
The main risk of CVE-2020-1620 is that a local, authenticated user can obtain hashed login password values from the configd streamer log.
Which versions of Junos OS Evolved are affected by CVE-2020-1620?
All versions of Junos OS Evolved prior to 19.3R1 are affected by CVE-2020-1620.
Who is impacted by CVE-2020-1620?
CVE-2020-1620 impacts any local, authenticated user with shell access to affected Junos OS Evolved systems.