Lucene search

MitreCVE-2019-18948

HistoryApr 16, 2020 - 7:15 p.m.

CVE-2019-18948

2020-04-1619:15:22

mitre

web.nvd.nist.gov

arista

eos

vxlan

arp

vxlanswfwd

cve-2019-18948

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M and below releases in the 4.22.x train, 4.23.1F and below releases in the 4.23.x train, and all releases in 4.15, 4.16, 4.17, 4.18, 4.19, 4.20 code train.

Affected configurations

Nvd

Node

aristaeosRange4.21.0–4.21.8m

aristaeosRange4.22.0–4.22.3m

aristaeosRange4.23.0–4.23.1f

aristaeosMatch4.15

aristaeosMatch4.16

aristaeosMatch4.17

aristaeosMatch4.18

aristaeosMatch4.19

aristaeosMatch4.20

VendorProductVersionCPE
aristaeos*cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
aristaeos4.15cpe:2.3:o:arista:eos:4.15:*:*:*:*:*:*:*
aristaeos4.16cpe:2.3:o:arista:eos:4.16:*:*:*:*:*:*:*
aristaeos4.17cpe:2.3:o:arista:eos:4.17:*:*:*:*:*:*:*
aristaeos4.18cpe:2.3:o:arista:eos:4.18:*:*:*:*:*:*:*
aristaeos4.19cpe:2.3:o:arista:eos:4.19:*:*:*:*:*:*:*
aristaeos4.20cpe:2.3:o:arista:eos:4.20:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arista	eos	*	cpe:2.3:o:arista:eos::::::::
arista	eos	4.15	cpe:2.3:o:arista:eos:4.15:::::::*
arista	eos	4.16	cpe:2.3:o:arista:eos:4.16:::::::*
arista	eos	4.17	cpe:2.3:o:arista:eos:4.17:::::::*
arista	eos	4.18	cpe:2.3:o:arista:eos:4.18:::::::*
arista	eos	4.19	cpe:2.3:o:arista:eos:4.19:::::::*
arista	eos	4.20	cpe:2.3:o:arista:eos:4.20:::::::*

References

www.arista.com/en/support/advisories-notices/security-advisories/10292-security-advisory-47

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

Related for CVE-2019-18948