Lucene search

[email protected]CVE-2021-28508

HistoryMay 26, 2022 - 8:15 p.m.

CVE-2021-28508

2022-05-2620:15:08

CWE-255

CWE-319

[email protected]

web.nvd.nist.gov

(arista

eos

telemetry

agent

vulnerability

terminattr

nvd

cve-2021-28508)

3.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:P/A:N

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device.

Affected configurations

NVD

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

aristaccs-722xpm-48y4Match-

aristaccs-722xpm-48zy8Match-

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

arista7050cx3-32sMatch-

arista7050cx3m-32sMatch-

arista7050sx3-48c8Match-

arista7050sx3-48ycMatch-

arista7050sx3-48yc12Match-

arista7050sx3-48yc8Match-

arista7050sx3-96yc8Match-

arista7050tx3-48c8Match-

aristadcs-7050cx3-32sMatch-

aristadcs-7050cx3-32s-rMatch-

aristadcs-7050cx3m-32sMatch-

aristadcs-7050sx3-48c8Match-

aristadcs-7050sx3-48yc12Match-

aristadcs-7050sx3-48yc8Match-

aristadcs-7050sx3-96yc8Match-

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

arista7280cr2ak-30Match-

arista7280cr2k-60Match-

arista7280cr3-32d4Match-

arista7280cr3-32p4Match-

arista7280cr3-96Match-

arista7280cr3k-32d4Match-

arista7280cr3k-32p4Match-

arista7280cr3k-96Match-

arista7280dr3-24Match-

arista7280dr3k-24Match-

arista7280pr3-24Match-

arista7280pr3k-24Match-

arista7280r2Match-

arista7280r3Match-

arista7280sr3-48yc8Match-

arista7280sr3k-48yc8Match-

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

arista7500r2Match-

arista7500r3Match-

arista7500r3-24dMatch-

arista7500r3-24pMatch-

arista7500r3-36cqMatch-

arista7500r3k-36cqMatch-

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

arista7800r3-36pMatch-

arista7800r3-48cqMatch-

arista7800r3k-48cqMatch-

Node

aristaterminattrRange<1.10.11

aristaterminattrRange1.11.0–1.16.8

aristaterminattrRange1.17.0–1.19.0

aristaeosRange4.23–4.23.11

aristaeosRange4.24–4.24.10

aristaeosRange4.25–4.25.8

aristaeosRange4.26–4.26.6

aristaeosRange4.27–4.27.2

AND

arista7388x5Match-

CPENameOperatorVersion
arista:terminattrarista terminattrlt1.10.11
arista:terminattrarista terminattrlt1.16.8
arista:terminattrarista terminattrlt1.19.0
arista:eosarista eosle4.23.11
arista:eosarista eoslt4.24.10
arista:eosarista eoslt4.25.8
arista:eosarista eoslt4.26.6
arista:eosarista eoslt4.27.2

CPE	Name	Operator	Version
arista:terminattr	arista terminattr	lt	1.10.11
arista:terminattr	arista terminattr	lt	1.16.8
arista:terminattr	arista terminattr	lt	1.19.0
arista:eos	arista eos	le	4.23.11
arista:eos	arista eos	lt	4.24.10
arista:eos	arista eos	lt	4.25.8
arista:eos	arista eos	lt	4.26.6
arista:eos	arista eos	lt	4.27.2

CNA Affected

[
  {
    "product": "Arista EOS",
    "vendor": "Arista Networks",
    "versions": [
      {
        "lessThanOrEqual": "4.23.11",
        "status": "affected",
        "version": "4.23",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.24.9",
        "status": "affected",
        "version": "4.24",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.25.7",
        "status": "affected",
        "version": "4.25",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.26.5",
        "status": "affected",
        "version": "4.26",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.27.3",
        "status": "affected",
        "version": "4.27",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Arista TerminAttr",
    "vendor": "Arista Networks",
    "versions": [
      {
        "lessThanOrEqual": "v1.10.10",
        "status": "affected",
        "version": " v1.10",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v1.16.7",
        "status": "affected",
        "version": "v1.16",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "v1.18.1",
        "status": "affected",
        "version": "v1.18",
        "versionType": "custom"
      }
    ]
  }
]

References

www.arista.com/en/support/advisories-notices/security-advisories/15484-security-advisory-0077

Social References

3.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:P/A:N

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

Related for CVE-2021-28508

cvelist1 prion1 nvd1 arista1