CVE-2023-28968
Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open
02 Description
Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 0.56% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 46.7% of scored records. A rank, not a probability.
- NVD base score
- 5.3 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2023-04-17 00:00Z3 YR AGO
- Last updated
- 2025-02-06 14:37Z1 YR AGO
- Reserved
- 2023-03-29
- Assigning CNA
- juniper
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.3)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- Data version
- 5.1
- Document digest
- 06f0f6c9baa12386685bb3859ee465ba62884bd673e46db4fe2f9ea960e0a873
05 Affected products
06 References
- supportportal.juniper.nethttps://supportportal.juniper.net/JSA70592
- www.juniper.nethttps://www.juniper.net/documentation/us/en/software/jdpi/release-notes/jdpi-decoder-release-notes-october-2022/jdpi-decoder-release-notes-october-2022.pdf
- supportportal.juniper.nethttps://supportportal.juniper.net/s/article/SRX-How-to-update-IDP-signature-database-automatically-on-a-SRX
07 Remediation
The following software releases have been updated to resolve this specific issue: 19.4R3-S11, 20.2R3-S7, 20.4R3-S6, 21.1R3-S5, 21.2R3-S4, 21.3R3-S3, 21.4R3-S3, 22.1R3-S1, 22.2R2-S1, 22.2R3, 22.3R1-S2, 22.3R2, 22.4R1, and all subsequent releases. Please note: Prior to Junos OS: 21.2R3-S4, 21.3R3-S3, 21.3R3-S3, 21.4R3-S3, 22.1R3-S1, 22.2R2-S1, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases SOF is incorrectly offloading short-lived flows leading to early exhaustion of NP memory, reducing overall device performance. Customers should review PRSearch PR1692100 for such details in conjunction with this advisory. Customers may choose to enable automatic updates for IDP or manually update the IDP security package to receive the fixes. To manually download the IDP signatures: a. Download the IDP security-package on the device: request security idp security-package download b. Check the status of the download: request security idp security-package download status c. Install the IDP security-package on the device: request security idp security-package install d. Check the status of the installation: request security idp security-package install status To enabled automatic update review the instuctions located at: https://supportportal.juniper.net/s/article/SRX-How-to-update-IDP-signature-database-automatically-on-a-SRX == When using AppID only: request services application-identification download request services application-identification download status request services