PT-2020-15263

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 8.1.16 Palo Alto Networks PAN-OS versions prior to 9.0.10 Palo Alto Networks PAN-OS versions prior to 9.1.4 Palo Alto Networks PAN-OS versions prior to 10.0.1 Description An uncontrolled resource...

PT-2020-15268

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions earlier than 8.1.16 Palo Alto Networks PAN-OS versions earlier than 9.0.10 Palo Alto Networks PAN-OS versions earlier than 9.1.4 Description The issue is an information exposure through log file vulnerability...

Design/Logic Flaw

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

CVE-2020-2035 PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

CVE-2020-2035

CVE-2020-2035 (PAN-OS) affects PAN-OS when SSL/TLS Forward Proxy Decryption is enabled. The URL filtering policy inspects HTTP Host/URL path but ignores the TLS Client Hello SNI, allowing a compromised host to evade policies on decrypted HTTPS traffic. Impact is described as low for integrity; no...

PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

Informational: BootHole Vulnerability Impact on Palo Alto Networks PAN-OS Software

Palo Alto Networks is aware of the vulnerability known as BootHole CVE-2020-10713 that affects the Grand Unified Bootloader GRUB used in Palo Alto Networks PAN-OS software. BootHole is a buffer overflow vulnerability that occurs in GRUB2 when parsing an attacker-controlled grub.cfg file. This...

PT-2020-15260

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 10.1 Description The PAN-OS URL filtering feature does not consider the Server Name Indication SNI field within the TLS Client Hello handshake when SSL/TLS Forward Proxy Decryption mode is enabled. This allows a...

The vulnerability of the GlobalProtect component of the PAN-OS operating system allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the GlobalProtect component of the PAN-OS operating system is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2020-2035: Improper Input Validation

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

The vulnerability of the PAN-OS operating system, related to incorrect restrictions on XML links to external objects, allows attackers to escalate their privileges.

The vulnerability of the PAN-OS operating system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...

The vulnerability of the PAN-OS operating system on PA-7000 devices, related to insufficient channel restrictions for specified endpoints, allows a perpetrator to gain access to the device with root privileges.

The vulnerability of the PAN-OS operating system on PA-7000 devices is related to insufficient restrictions on communication channels for specified endpoints. Exploiting this vulnerability can allow a malicious actor to gain access to the device with root privileges...

The vulnerability of the logd daemon in the PAN-OS operating system allows a perpetrator to execute arbitrary code and increase their privileges.

The vulnerability of logd daemon in the PAN-OS operating system is related to the use of an uncontrolled format string. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain elevated privileges...

The vulnerability of the PAN-OS operating system, related to deficiencies in authentication procedures, allows attackers to gain superuser privileges.

The vulnerability of the PAN-OS operating system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to gain superuser privileges...

Palo Alto Networks PAN-OS Encryption Issue Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A cryptographic issue vulnerability exists in Palo Alto Networks PAN-OS that stems from the program's use of a weak encryption protocol, TLS version 1.0. An attacker could exploit this...

Palo Alto Networks PAN-OS OS Command Injection Vulnerability

PAN-OS is an operating system designed specifically for the security and control of Palo Alto Networks firewalls, with a rich set of firewall, management and network features. An OS command injection vulnerability exists in the GlobalProtect portal of PAN-OS. An attacker can exploit this...

Palo Alto Networks PAN-OS 9.1.x < 9.1.3 Integer Underflow Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 9.1.x prior to 9.1.3. It is, therefore, affected by an integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface. This allows authenticated administrators to issue a command from the command...

Palo Alto Networks PAN-OS 8.x < 8.1.15 / 9.0.x < 9.0.9 / 9.1.x < 9.1.3 TLS 1.0 Usage Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.x prior to 8.1.15 or 9.0.x prior to 9.0.9 or 9.1.x prior to 9.1.3. It is, therefore, affected by a TLS 1.0 usage vulnerability. Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, whi...

Palo Alto Networks PAN-OS 7.1.x / 8.x < 8.1.15 OS Command Injection Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x or 8.x prior to 8.1.15. It is, therefore, affected by a OS command injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges...

Palo Alto Networks PAN-OS 7.1.x < 8.1.15 / 9.0.x < 9.0.9 / 9.1.x < 9.1.3 GlobalProtect Command Injection Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.15 or 9.0.x prior to 9.0.9 or 9.1.x prior to 9.1.3. It is, therefore, affected by a command injection vulnerability exists in the GlobalProtect portal. An unauthenticated, remote attacker can exploit this, t...