security-advisory-0046

This advisory documents the exposure of Arista's products to a security vulnerability in an open-source software, Go. Arista has not received evidence of this vulnerability being exploited, as of the date of the initial release of this advisory. The exploitation of this vulnerability on affected software can lead to panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates. In EOS, the exposure is limited to the state streaming components - TerminAttr and OpenConfig. TerminAttr and OpenConfig are shipped natively with EOS but are not enabled by default. If either service is enabled, the service will be affected by this security vulnerability.