CVE-2020-1624: Junos OS Evolved: objmon logs may leak sensitive information
A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affects all versions of Junos OS Evolved prior to 19.1R1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 19.1R1-EVO - Upgrade
Upgrade
Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 19.2R2-EVO
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1624?
CVE-2020-1624 has a medium severity rating due to its potential to expose hashed login passwords.
How do I fix CVE-2020-1624?
The recommended fix for CVE-2020-1624 is to upgrade to Junos OS Evolved version 19.1R1 or later.
Who is affected by CVE-2020-1624?
CVE-2020-1624 affects all versions of Junos OS Evolved prior to 19.1R1 that are used by local, authenticated users.
What type of users can exploit CVE-2020-1624?
CVE-2020-1624 can be exploited by local, authenticated users with shell access.
What information is compromised in CVE-2020-1624?
CVE-2020-1624 allows users to obtain the hashed values of login passwords and shared secrets.