CVE-2023-28978: Junos OS Evolved: Read access to some confidential user information is possible
First published: Mon Apr 17 2023(Updated: )
An Insecure Default Initialization of Resource vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to read certain confidential information. In the default configuration it is possible to read confidential information about locally configured (administrative) users of the affected system. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S7-EVO on pending commit???; 21.1-EVO versions prior to 21.1R3-S4-EVO on awaiting build; 21.4-EVO versions prior to 21.4R3-S1-EVO; 22.2-EVO versions prior to 22.2R3-EVO; 21.2-EVO versions prior to 21.2R3-S5-EVO on pending commit???; 21.3-EVO version 21.3R1-EVO and later versions; 22.1-EVO version 22.1R1-EVO and later versions; 22.2-EVO versions prior to 22.2R2-S1-EVO.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Junos OS Evolved | <20.4 | |
| Junos OS Evolved | =20.4 | |
| Junos OS Evolved | =20.4-r1 | |
| Junos OS Evolved | =20.4-r1-s1 | |
| Junos OS Evolved | =20.4-r1-s2 | |
| Junos OS Evolved | =20.4-r2 | |
| Junos OS Evolved | =20.4-r2-s1 | |
| Junos OS Evolved | =20.4-r2-s2 | |
| Junos OS Evolved | =20.4-r2-s3 | |
| Junos OS Evolved | =20.4-r3 | |
| Junos OS Evolved | =20.4-r3-s1 | |
| Junos OS Evolved | =20.4-r3-s2 | |
| Junos OS Evolved | =20.4-r3-s3 | |
| Junos OS Evolved | =20.4-r3-s4 | |
| Junos OS Evolved | =20.4-r3-s5 | |
| Junos OS Evolved | =20.4-r3-s6 | |
| Junos OS Evolved | =21.1 | |
| Junos OS Evolved | =21.1-r1 | |
| Junos OS Evolved | =21.1-r1-s1 | |
| Junos OS Evolved | =21.1-r2 | |
| Junos OS Evolved | =21.1-r3 | |
| Junos OS Evolved | =21.1-r3-s1 | |
| Junos OS Evolved | =21.1-r3-s2 | |
| Junos OS Evolved | =21.1-r3-s3 | |
| Junos OS Evolved | =21.2 | |
| Junos OS Evolved | =21.2-r1 | |
| Junos OS Evolved | =21.2-r1-s1 | |
| Junos OS Evolved | =21.2-r1-s2 | |
| Junos OS Evolved | =21.2-r2 | |
| Junos OS Evolved | =21.2-r2-s1 | |
| Junos OS Evolved | =21.2-r2-s2 | |
| Junos OS Evolved | =21.2-r3 | |
| Junos OS Evolved | =21.2-r3-s1 | |
| Junos OS Evolved | =21.2-r3-s2 | |
| Junos OS Evolved | =21.2-r3-s3 | |
| Junos OS Evolved | =21.2-r3-s4 | |
| Junos OS Evolved | =21.3-r1 | |
| Junos OS Evolved | =21.3-r1-s1 | |
| Junos OS Evolved | =21.3-r2 | |
| Junos OS Evolved | =21.3-r2-s1 | |
| Junos OS Evolved | =21.3-r2-s2 | |
| Junos OS Evolved | =21.3-r3 | |
| Junos OS Evolved | =21.3-r3-s1 | |
| Junos OS Evolved | =21.3-r3-s2 | |
| Junos OS Evolved | =21.3-r3-s3 | |
| Junos OS Evolved | =21.4 | |
| Junos OS Evolved | =21.4-r1 | |
| Junos OS Evolved | =21.4-r1-s1 | |
| Junos OS Evolved | =21.4-r1-s2 | |
| Junos OS Evolved | =21.4-r2 | |
| Junos OS Evolved | =21.4-r2-s1 | |
| Junos OS Evolved | =21.4-r2-s2 | |
| Junos OS Evolved | =21.4-r3 | |
| Junos OS Evolved | =22.1-r1 | |
| Junos OS Evolved | =22.1-r1-s1 | |
| Junos OS Evolved | =22.1-r1-s2 | |
| Junos OS Evolved | =22.1-r2 | |
| Junos OS Evolved | =22.1-r2-s1 | |
| Junos OS Evolved | =22.1-r3 | |
| Junos OS Evolved | =22.2-r1 | |
| Junos OS Evolved | =22.2-r1-s1 | |
| Junos OS Evolved | =22.2-r2 | |
| Junos OS Evolved | =22.2-r2-s1 |
Remedy
The following software releases have been updated to resolve this specific issue: 20.4R3-S7-EVO, 21.1R3-S4-EVO, 21.2R3-S5-EVO, 21.4R3-S1-EVO, 22.2R2-EVO, 22.3R1-EVO, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-28978?
CVE-2023-28978 is classified as a high severity vulnerability affecting Juniper Networks Junos OS Evolved.
How do I fix CVE-2023-28978?
To fix CVE-2023-28978, it is essential to apply the latest security patches provided by Juniper Networks for affected versions of Junos OS Evolved.
What are the affected versions of CVE-2023-28978?
CVE-2023-28978 affects Junos OS Evolved versions up to and including 20.4 and specific versions up to 22.2.
Who can exploit CVE-2023-28978?
CVE-2023-28978 can be exploited by unauthenticated network-based attackers to access confidential information.
What type of vulnerability is CVE-2023-28978?
CVE-2023-28978 is an Insecure Default Initialization of Resource vulnerability.
- agent/type
- agent/remedy
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/juniper
- canonical/junos os evolved
- version/junos os evolved/20.4
- version/junos os evolved/20.4-r1
- version/junos os evolved/20.4-r1-s1
- version/junos os evolved/20.4-r1-s2
- version/junos os evolved/20.4-r2
- version/junos os evolved/20.4-r2-s1
- version/junos os evolved/20.4-r2-s2
- version/junos os evolved/20.4-r2-s3
- version/junos os evolved/20.4-r3
- version/junos os evolved/20.4-r3-s1
- version/junos os evolved/20.4-r3-s2
- version/junos os evolved/20.4-r3-s3
- version/junos os evolved/20.4-r3-s4
- version/junos os evolved/20.4-r3-s5
- version/junos os evolved/20.4-r3-s6
- version/junos os evolved/21.1
- version/junos os evolved/21.1-r1
- version/junos os evolved/21.1-r1-s1
- version/junos os evolved/21.1-r2
- version/junos os evolved/21.1-r3
- version/junos os evolved/21.1-r3-s1
- version/junos os evolved/21.1-r3-s2
- version/junos os evolved/21.1-r3-s3
- version/junos os evolved/21.2
- version/junos os evolved/21.2-r1
- version/junos os evolved/21.2-r1-s1
- version/junos os evolved/21.2-r1-s2
- version/junos os evolved/21.2-r2
- version/junos os evolved/21.2-r2-s1
- version/junos os evolved/21.2-r2-s2
- version/junos os evolved/21.2-r3
- version/junos os evolved/21.2-r3-s1
- version/junos os evolved/21.2-r3-s2
- version/junos os evolved/21.2-r3-s3
- version/junos os evolved/21.2-r3-s4
- version/junos os evolved/21.3-r1
- version/junos os evolved/21.3-r1-s1
- version/junos os evolved/21.3-r2
- version/junos os evolved/21.3-r2-s1
- version/junos os evolved/21.3-r2-s2
- version/junos os evolved/21.3-r3
- version/junos os evolved/21.3-r3-s1
- version/junos os evolved/21.3-r3-s2
- version/junos os evolved/21.3-r3-s3
- version/junos os evolved/21.4
- version/junos os evolved/21.4-r1
- version/junos os evolved/21.4-r1-s1
- version/junos os evolved/21.4-r1-s2
- version/junos os evolved/21.4-r2
- version/junos os evolved/21.4-r2-s1
- version/junos os evolved/21.4-r2-s2
- version/junos os evolved/21.4-r3
- version/junos os evolved/22.1-r1
- version/junos os evolved/22.1-r1-s1
- version/junos os evolved/22.1-r1-s2
- version/junos os evolved/22.1-r2
- version/junos os evolved/22.1-r2-s1
- version/junos os evolved/22.1-r3
- version/junos os evolved/22.2-r1
- version/junos os evolved/22.2-r1-s1
- version/junos os evolved/22.2-r2
- version/junos os evolved/22.2-r2-s1