01 Record

CVE-2023-28968

Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open

MediumPUBLISHEDCNA: juniper

CNA base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

View raw JSON

02 Description

Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail open

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.57% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 44.6% of scored records. A rank, not a probability.

NVD base score

5.3 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-04-17 00:00Z3 YR AGO

Last updated

2025-02-06 14:37Z1 YR AGO

Reserved

2023-03-29

Assigning CNA

juniper

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-1325Improperly Controlled Sequential Memory AllocationBase
CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

06f0f6c9baa12386685bb3859ee465ba62884bd673e46db4fe2f9ea960e0a873

05 Affected products

VendorProductVersionsPlatforms

Juniper NetworksJunos OS< 19.1R3-S10, 19.2 to < 19.2R3-S7, 19.3 to < 19.3R3-S8, 19.4 to < 19.4R3-S11, 20.1R1 to < 20.1*, 20.2 to < 20.2R3-S7, 20.3R1 to < 20.3*, 20.4 to < 20.4R3-S6, 21.1 to < 21.1R3-S5, 21.2 to < 21.2R3-S4, 21.3 to < 21.3R3-S3, 21.4 to < 21.4R3-S3, 22.1 to < 22.1R3-S1, 22.2 to < 22.2R2-S1, 22.2R3, 22.3 to < 22.3R2SRX Series

Juniper NetworksAppID Service Sigpack< 1.550.2-31SRX Series

Juniper NetworksJDPI-Decoder Engine< 5.7.0-47SRX Series

06 References

supportportal.juniper.nethttps://supportportal.juniper.net/JSA70592
www.juniper.nethttps://www.juniper.net/documentation/us/en/software/jdpi/release-notes/jdpi-decoder-release-notes-october-2022/jdpi-decoder-release-notes-october-2022.pdf
supportportal.juniper.nethttps://supportportal.juniper.net/s/article/SRX-How-to-update-IDP-signature-database-automatically-on-a-SRX

07 Remediation

The following software releases have been updated to resolve this specific issue: 19.4R3-S11, 20.2R3-S7, 20.4R3-S6, 21.1R3-S5, 21.2R3-S4, 21.3R3-S3, 21.4R3-S3, 22.1R3-S1, 22.2R2-S1, 22.2R3, 22.3R1-S2, 22.3R2, 22.4R1, and all subsequent releases. Please note: Prior to Junos OS: 21.2R3-S4, 21.3R3-S3, 21.3R3-S3, 21.4R3-S3, 22.1R3-S1, 22.2R2-S1, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases SOF is incorrectly offloading short-lived flows leading to early exhaustion of NP memory, reducing overall device performance. Customers should review PRSearch PR1692100 for such details in conjunction with this advisory. Customers may choose to enable automatic updates for IDP or manually update the IDP security package to receive the fixes. To manually download the IDP signatures: a. Download the IDP security-package on the device: request security idp security-package download b. Check the status of the download: request security idp security-package download status c. Install the IDP security-package on the device: request security idp security-package install d. Check the status of the installation: request security idp security-package install status To enabled automatic update review the instuctions located at: https://supportportal.juniper.net/s/article/SRX-How-to-update-IDP-signature-database-automatically-on-a-SRX == When using AppID only: request services application-identification download request services application-identification download status request services

01 Record index

CVE-2023-28968

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation

02 Records

CVE-2023-28968

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation