On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train
References
Link | Resource |
---|---|
https://www.arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Arista
Published: 2021-10-19T00:00:00
Updated: 2021-10-21T16:41:47
Reserved: 2021-03-16T00:00:00
Link: CVE-2021-28496
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-10-21T17:15:07.740
Modified: 2022-07-30T12:29:59.813
Link: CVE-2021-28496
JSON object: View
Redhat Information
No data.