CVE-2021-0297

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured with MD5 authentication to succeed, even if the peer does not have TCP MD5 authentication enabled. This could lead to untrusted or unauthorized sessions being established, resulting in an impact on confidentiality or stability of the network. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.3R2-S1-EVO; 20.4 versions prior to 20.4R2-EVO; 21.1 versions prior to 21.1R2-EVO. Juniper Networks Junos OS is not affected by this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published
Oct 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-02984.7A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface coCVE-2021-02997.5An Improper Handling of Exceptional Conditions vulnerability in the processing of a transit or directly received malformed IPv6 packet in JuCVE-2021-03016.7In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System CVE-2021-03027.8In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilegCVE-2021-03037.0In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after CVE-2021-03045.5In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to locaCVE-2021-03057.8In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilegCVE-2021-03067.8In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which alCVE-2021-03077.8In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused CVE-2021-03086.8In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatiCVE-2021-03095.5In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account aCVE-2021-03107.8In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to local
CVE-2021-0297: Medium severity, CVSS 6.5 | Vulnix