high
7.5
CWE
908
Advisory Published
Updated

CVE-2023-28967: Junos OS and Junos OS Evolved: An attacker sending genuine BGP packets causes an RPD crash

First published: Mon Apr 17 2023(Updated: )

A Use of Uninitialized Resource vulnerability in the Border Gateway Protocol (BGP) software of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to send specific genuine BGP packets to a device configured with BGP to cause a Denial of Service (DoS) by crashing the Routing Protocol Daemon (rpd). This issue is triggered when the packets attempt to initiate a BGP connection before a BGP session is successfully established. Continued receipt of these specific BGP packets will cause a sustained Denial of Service condition. This issue is triggerable in both iBGP and eBGP deployments. This issue affects: Juniper Networks Junos OS 21.1 version 21.1R1 and later versions prior to 21.1R3-S5; 21.2 version 21.2R1 and later versions prior to 21.2R3-S2; 21.3 version 21.3R1 and later versions prior to 21.3R3-S2; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R3; 22.2 versions prior to 22.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 21.1R1. This issue affects: Juniper Networks Junos OS Evolved 21.1-EVO version 21.1R1-EVO and later versions prior to 21.4R3-EVO; 22.1-EVO versions prior to 22.1R3-EVO; 22.2-EVO versions prior to 22.2R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 21.1R1-EVO.

Credit: sirt@juniper.net

Affected SoftwareAffected VersionHow to fix
Juniper Networks Junos OS Evolved=21.1
Juniper Networks Junos OS Evolved=21.1-r1
Juniper Networks Junos OS Evolved=21.1-r1-s1
Juniper Networks Junos OS Evolved=21.1-r2
Juniper Networks Junos OS Evolved=21.1-r3
Juniper Networks Junos OS Evolved=21.1-r3-s1
Juniper Networks Junos OS Evolved=21.1-r3-s2
Juniper Networks Junos OS Evolved=21.1-r3-s3
Juniper Networks Junos OS Evolved=21.2
Juniper Networks Junos OS Evolved=21.2-r1
Juniper Networks Junos OS Evolved=21.2-r1-s1
Juniper Networks Junos OS Evolved=21.2-r1-s2
Juniper Networks Junos OS Evolved=21.2-r2
Juniper Networks Junos OS Evolved=21.2-r2-s1
Juniper Networks Junos OS Evolved=21.2-r2-s2
Juniper Networks Junos OS Evolved=21.2-r3
Juniper Networks Junos OS Evolved=21.2-r3-s1
Juniper Networks Junos OS Evolved=21.2-r3-s2
Juniper Networks Junos OS Evolved=21.2-r3-s3
Juniper Networks Junos OS Evolved=21.2-r3-s4
Juniper Networks Junos OS Evolved=21.2-r3-s5
Juniper Networks Junos OS Evolved=21.3
Juniper Networks Junos OS Evolved=21.3-r1
Juniper Networks Junos OS Evolved=21.3-r1-s1
Juniper Networks Junos OS Evolved=21.3-r2
Juniper Networks Junos OS Evolved=21.3-r2-s1
Juniper Networks Junos OS Evolved=21.3-r2-s2
Juniper Networks Junos OS Evolved=21.3-r3
Juniper Networks Junos OS Evolved=21.3-r3-s1
Juniper Networks Junos OS Evolved=21.3-r3-s2
Juniper Networks Junos OS Evolved=21.3-r3-s3
Juniper Networks Junos OS Evolved=21.3-r3-s4
Juniper Networks Junos OS Evolved=21.4
Juniper Networks Junos OS Evolved=21.4-r1
Juniper Networks Junos OS Evolved=21.4-r1-s1
Juniper Networks Junos OS Evolved=21.4-r1-s2
Juniper Networks Junos OS Evolved=21.4-r2
Juniper Networks Junos OS Evolved=21.4-r2-s1
Juniper Networks Junos OS Evolved=21.4-r2-s2
Juniper Networks Junos OS Evolved=22.1-r1
Juniper Networks Junos OS Evolved=22.1-r1-s1
Juniper Networks Junos OS Evolved=22.1-r1-s2
Juniper Networks Junos OS Evolved=22.1-r2
Juniper Networks Junos OS Evolved=22.1-r2-s1
Juniper Networks Junos OS Evolved=22.2-r1
Juniper Networks Junos OS Evolved=22.2-r1-s1
Juniper JUNOS=21.1
Juniper JUNOS=21.1-r1
Juniper JUNOS=21.1-r1-s1
Juniper JUNOS=21.1-r2
Juniper JUNOS=21.1-r2-s1
Juniper JUNOS=21.1-r2-s2
Juniper JUNOS=21.1-r3
Juniper JUNOS=21.1-r3-s1
Juniper JUNOS=21.1-r3-s2
Juniper JUNOS=21.1-r3-s3
Juniper JUNOS=21.1-r3-s4
Juniper JUNOS=21.2
Juniper JUNOS=21.2-r1
Juniper JUNOS=21.2-r1-s1
Juniper JUNOS=21.2-r1-s2
Juniper JUNOS=21.2-r2
Juniper JUNOS=21.2-r2-s1
Juniper JUNOS=21.2-r2-s2
Juniper JUNOS=21.2-r3
Juniper JUNOS=21.2-r3-s1
Juniper JUNOS=21.3
Juniper JUNOS=21.3-r1
Juniper JUNOS=21.3-r1-s1
Juniper JUNOS=21.3-r1-s2
Juniper JUNOS=21.3-r2
Juniper JUNOS=21.3-r2-s1
Juniper JUNOS=21.3-r2-s2
Juniper JUNOS=21.3-r3
Juniper JUNOS=21.3-r3-s1
Juniper JUNOS=21.4
Juniper JUNOS=21.4-r1
Juniper JUNOS=21.4-r1-s1
Juniper JUNOS=21.4-r1-s2
Juniper JUNOS=21.4-r2
Juniper JUNOS=21.4-r2-s1
Juniper JUNOS=21.4-r2-s2
Juniper JUNOS=22.1-r1
Juniper JUNOS=22.1-r1-s1
Juniper JUNOS=22.1-r1-s2
Juniper JUNOS=22.1-r2
Juniper JUNOS=22.1-r2-s1
Juniper JUNOS=22.1-r2-s2
Juniper JUNOS=22.2-r1
Juniper JUNOS=22.2-r1-s1
Juniper JUNOS=22.2-r1-s2

Remedy

The following software releases have been updated to resolve this specific issue: Junos OS: 21.1R3-S5, 21.2R3-S2, 21.3R3-S2, 21.4R3, 22.1R3, 22.2R2, 22.3R1, and all subsequent releases. Junos OS Evolved: 21.4R3-EVO, 22.1R3-EVO, 22.2R2-EVO, 22.3R1-EVO, and all subsequent releases.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2023-28967?

    CVE-2023-28967 is categorized as a high severity vulnerability due to its potential to cause a Denial of Service.

  • How do I fix CVE-2023-28967?

    To mitigate CVE-2023-28967, you should upgrade to the latest patched version of Juniper Networks Junos OS as advised by the vendor.

  • Which versions of Junos OS are affected by CVE-2023-28967?

    CVE-2023-28967 affects several versions of Junos OS Evolved and Junos, specifically those in the 21.1, 21.2, 21.3, 21.4, and 22.1 series.

  • What type of attack can exploit CVE-2023-28967?

    An unauthenticated network-based attacker can exploit CVE-2023-28967 by sending specially crafted BGP packets to a vulnerable device.

  • Is there a workaround for CVE-2023-28967?

    Currently, a specific workaround for CVE-2023-28967 is not provided, thus upgrading to a fixed version is the recommended action.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203