Juniper caught by third-party bugs dating back to 2016

Juniper Networks has issued three advisories for critical bugs in a mammoth patch release covering more than 30 vulnerabilities.

The first critical advisory covers more than 100 third-party patches in Contrail Cloud release 13.7.0. 

The networking vendor said the vulnerabilities could also affect all older Contrail Cloud versions.

The bugs are apparently mostly inherited from libraries shipping with Red Hat’s OpenStack 13.0.z15, and date back to 2016.

The most critical bugs in the patch cover libxml2, the Apache HTTP server, Python 3.x, and the Expat library.

Multiple third-party vulnerabilities in Junos Space version 22.3R1 are covered in this advisory.

The critical bugs are a use-after-free in systemd, a buffer overflow in Python 3 through 3.9.1, and an arbitrary file write in the zgrep utility.

The final critical advisory covers 32 third-party vulnerabilities in all versions of Contrail Service Orchestration prior to 6.3.0, including a privilege escalation bug in sudo, denial of service bugs in ngnix and dnsmasq, and bugs in Kerberos and OpenSSL.

The full list of advisories is here.