CVE-2019-17596

CVE-2019-17596 affects Go (Go before 1.12.11 and 1.3.x before 1.13.2) and can cause a panic when processing network traffic that contains an invalid DSA public key, e.g., traffic between clients and servers that verify client certificates. Connected advisories show affected Go versions and explic...

CVE-2021-28508

CVE-2021-28508 affects Arista EOS with TerminAttr and OpenConfig transport enabled. Under certain conditions TerminAttr or Octa may leak IPsec data in clear text to CloudVision/gNMI authorized users, allowing potential decryption/modification of IPsec traffic. Affected EOS versions when Octa is i...

CVE-2021-28509

CVE-2021-28509 : Arista EOS TerminAttr and OpenConfig transport can leak MACsec data in clear text to authorized users, enabling potential decryption/modification of MACsec traffic. Affected: EOS devices with Octa and TerminAttr enabled; specific affected versions include EOS 4.23.x–4.27.x trains...

CVE-2021-28501

The CVE-2021-28501 issue in Arista EOS concerns the incorrect use of EOS AAA APIs by the OpenConfig and TerminAttr agents, which could allow unrestricted access for local users configured with nopassword. Connected advisories confirm this affects OpenConfig gNMI/gNOI and TerminAttr and provide co...