Skip to content
CVE PROGRAM SOURCE RECORD5.7 Medium

CVE-2021-28496

In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arista

Description

On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arista Networks Arista EOS

  • EOS-4.22 to ≤ EOS-4.22.12affected
  • EOS-4.23 to < EOS-4.23.10affected
  • EOS-4.24 to < EOS-4.24.8affected
  • EOS-4.25 to < EOS-4.25.5affected
  • EOS-4.26 to < EOS-4.26.2affected

References