CVE-2021-28505

Summary

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

Affected Software

Weaknesses

• CWE-284: CWE-284 Improper Access Control

Workarounds

Replace "vxlan" IP protocol match with match on IP protocol "udp" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. < br/> If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number.

ADP Enrichment

CVE Program Container

Additional References

• https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073

References

• https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073

• ←Previous
• Next→