---
type: Addressed
product: PAN-OS
version: 8.1.14
---

## WF500-5185

```caveat
WF-500 appliances only
```

Fixed an issue where inadequate rotation of log files caused unusually high disk usage.

## PAN-140270

Added debugging task to periodically collect output (in the Tech Support File (TSF) from the `debug dataplane internal pdt bcm counters graphical` CLI command.

## PAN-139555

Fixed an issue in a high availability (HA) configuration where, after upgrading the passive firewall, the outer UDP sessions synced from the active firewall did not retain rule information and GPRS tunneling protocol (GTP) inspection failed after failover.

## PAN-137673

Fixed an issue where a memory leak associated with the (devsrvr) process caused an out-of-memory (OOM) condition on the firewall.

## PAN-136820

Fixed an issue where an HA failover occurred after the firewall reported the following error message in the System log: `Dataplane down: controlplane exit failure`.

## PAN-136470

Fixed an issue where a process (all_pktproc) restarted and caused the dataplane to restart after processing packets with 0.0.0.0 and destination protocol 251 that internally mapped to GTP-C traffic.

## PAN-135909

Fixed an issue where connections to the web interface were abruptly interrupted due to a double free condition (gPanUiPhpGlobal_secure_config_reset), which led to unexpected process restarts.

## PAN-135684

Fixed an issue with log collectors on Panorama where large indexes caused higher than expected CPU usage when disk space usage was high.

## PAN-134707

Fixed an issue where a commit took longer than expected after upgrading when **Negate** was enabled for addresses in a rule.

## PAN-134547

Fixed an issue where the passive firewall in an active/passive HA configuration deleted BGP-learned routes that were synchronized from the active firewall when the BGP configuration included the redistribution of the learned routes.

## PAN-134431

Fixed an issue with Security Assertion Markup Language (SAML) authentication where the firewall used old `authd_id` values, which resulted in failed authentication.

## PAN-134370

Fixed an issue where a process (mp-relay) restarted due to missing routes or next hops.

## PAN-133289

Fixed an issue where improper parsing of the URL database caused high device-server CPU usage.

## PAN-132898

Fixed an intermittent issue where logs were missing with `log_index` debug messages due to merging of the index.

## PAN-131939

Fixed an issue where the dataplane restarted during file transfer due to one or more content updates being installed at the same time.

## PAN-131922

Fixed an issue where the certificate was not automatically pushed to the firewall until you manually fetched the certificate from the firewall.

## PAN-131517

Fixed an issue with a memory corruption error that caused a process (all_pktproc) to restart.

## PAN-131501

Fixed an issue when configuring Clientless VPN and executing the `portal-getconfig` CLI command where user groups were retrieved but were not freed, which caused a memory leak in the sslvpn process.

## PAN-130750

Fixed an issue where a commit failed on the firewall after disabling **Pre-Defined Reports** from Panorama.

## PAN-130361

A fix was made to address an external control of filename vulnerability in the SD-WAN component of Palo Alto Networks Panorama ([CVE-2020-2009](https://security.paloaltonetworks.com/CVE-2020-2009)).

## PAN-129328

Fixed an issue where packet descriptor (on-chip) usage reached 100% even though buffers, throughput, and session counts were not elevated.

## PAN-129289

Fixed an issue where export failed for a large running-config.xml file using the XML API.

## PAN-128568

Fixed a rare issue where a process (pan_task) restarted due to a NULL pointer exception.

## PAN-128330

Fixed an issue where the response for the XML API call for the `show object registered-ip all` operational CLI command included extra appended content.

## PAN-127614

Fixed an issue where SNMPv3 monitoring of the firewall failed from the Zabbix server after a firewall reboot or SNMP process restart on the firewall.

## PAN-127189

Fixed an issue where images displayed through the Clientless VPN were corrupted.

## PAN-127118

A fix was made to address an OS command line injection vulnerability in the PAN-OS management server where authenticated users were able to inject arbitrary shell commands with root privileges ([CVE-2020-2014](https://security.paloaltonetworks.com/CVE-2020-2014)).

## PAN-127004

Fixed an issue where a process (sysd) restarted due to missing heartbeats.

## PAN-126817

Fixed an issue where Security Assertion Markup Language (SAML) response validation failed with a certificate mismatch error even when the firewall had the same certificate on the identity provider.

## PAN-126362

A fix was made to address a command injection vulnerability in the PAN-OS management interface where an authenticated administrator was able to execute arbitrary OS commands with root privileges ([CVE-2020-2010](https://security.paloaltonetworks.com/CVE-2020-2010)).

## PAN-126205

Fixed an issue where role-based administrators were unable to import certificate private keys onto firewalls.

## PAN-125934

Fixed an issue on Panorama where a commit failed when bootstrapping a firewall to a configuration with a serial number of "unknown." The commit failed with the following error message: `mgt-config -> devices -> unknown unknown is invalid`.

## PAN-125889

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where auto-tagging failed for log forwarding.

## PAN-125794

Fixed an issue where a role-based adminstrator with CLI access was unable to successfully execute the `commit-partial` CLI command to commit only changes made by themselves.

## PAN-125730

Fixed an issue where packets tagged with IP protocol 252 were incorrectly treated as GPRS tunneling protocol (GTP) traffic, which caused the packet processor to terminate.

## PAN-125534

```caveat
PA-5200 Series and PA-7000 Series firewalls only
```

Fixed an issue where firewalls experienced high packet descriptor (on-chip) usage during uploads to the WildFire Cloud or WF-500 appliance.

## PAN-125527

Fixed an issue where multilayer ZIP-file inspection caused software buffer corruption and caused the all_pktproc process to restart.

## PAN-125410

Fixed an issue where a new GPRS tunneling protocol version 2 control plane (GTPv2-C) session reused GTP-C tunnel parameters within two seconds after deleting the old GTP-C session, which caused a session conflict on the firewall.

## PAN-124039

A fix was made to address an issue where the GlobalProtect Portal feature in PAN-OS did not set a new session identifier after a successful user login ([CVE-2020-1993](https://security.paloaltonetworks.com/CVE-2020-1993)).

## PAN-123637

```caveat
PA-3200 Series firewalls only
```

Fixed an issue where configuring 1G small form-factor pluggable (SFP) ports on a firewall with forced speed mode (of 1G) enabled made the link unusable when forced speed mode (of 1G) was also enabled on the peer firewall.

## PAN-122432

Fixed an issue where the firewall failed to correctly read the virtual system (vsys), which eventually resulted in a management server process restart.

## PAN-121626

```caveat
PA-3200 Series firewalls only
```

Fixed an intermittent issue where firewalls dropped packets, which caused issues such as traffic latency, slow file transfers, reduced throughput, internal path monitoring failures, and application failures.

## PAN-119806

Fixed an issue where the dataplane restarted due to internal packet path monitoring failure.

## PAN-118226

A fix was made to address an improper input validation vulnerability in the configuration daemon of Palo Alto Networks Panorama ([CVE-2020-2011](https://security.paloaltonetworks.com/CVE-2020-2011)).

## PAN-117955

A fix was made to address a missing authorization vulnerability in the Panorama management server ([CVE-2020-1996](https://security.paloaltonetworks.com/CVE-2020-1996)).

## PAN-117480

A fix was made to upgrade Nginx software included with PAN-OS ([PAN-SA-2020-0006](https://security.paloaltonetworks.com/PAN-SA-2020-0006) / CVE-2016-4450 and CVE-2013-0337).

## PAN-116480

Fixed an issue in Panorama where the `show system search-engine-quota` CLI command, the `show log-collector serial-number <log-collector_SN>` CLI command, and **Statistics** (**Panorama > Managed Collectors > Statistics**) showed incorrect log retention data.

## PAN-116189

Fixed an issue where Session Initiation Protocol (SIP) calls failed and displayed the following error message: `end-reason : resources-unavailable`.

## PAN-102688

A fix was made to address an OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS ([CVE-2020-2008](https://security.paloaltonetworks.com/CVE-2020-2008)).

## PAN-102682

A fix was made to address an OS command injection vulnerability in the management component of PAN-OS where an authenticated user was able to potentially execute arbitrary commands with root privileges ([CVE-2020-2007](https://security.paloaltonetworks.com/CVE-2020-2007)).

## PAN-100855

A fix was made to address a stack-based buffer overflow vulnerability in the management server component of PAN-OS where an authenticated user was able to execute arbitrary code with root privileges ([CVE-2020-2006](https://security.paloaltonetworks.com/CVE-2020-2006)).

## PAN-100415

A fix was made to address an external control of filename vulnerability in the command processing of PAN-OS ([CVE-2020-2003](https://security.paloaltonetworks.com/CVE-2020-2003)).

## PAN-100006

```caveat
PA-200 firewalls only
```

Fixed an issue where the User-ID™ process caused an out-of-memory (OOM) condition when the number of IP address tags monitored from Amazon Web Services (AWS) VM Monitoring was greater than the maximum supported number.

## PAN-96104

Fixed an issue in the web interface where the language preference reverted to English after logging out from a session that was authenticated by Security Assertion Language Markup (SAML) single sign-on (SSO).

## PAN-88136

Fixed a rare issue where a URL update caused the dataplane to restart.

## PAN-82052

A fix was made to address an open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS ([CVE-2020-1997](https://security.paloaltonetworks.com/CVE-2020-1997)).

## PAN-71148

Fixed an issue on Panorama where the **ACC** tab did not show data for the period before the daylight saving time (DST) change.
