---
type: Addressed
product: PAN-OS
version: 8.1.16
---

## WF500-5466

Fixed an issue where the timeout for downloading a PDF of a WildFire analysis report was too short, which caused missing reports and 404 errors.

## PAN-151978

A fix was made to address an insecure configuration of a daemon (appweb) that allowed a remote unauthenticated user to send a specifically crafted request to the device that caused the Appweb service to crash. Repeated attempts to send this request resulted in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode ([CVE-2020-2041](https://security.paloaltonetworks.com/CVE-2020-2041)).

## PAN-150243

Fixed an issue where after a successful commit, the candidate configuration was not updated to running configuration when initiated by an API-privileges-only custom role based administrator.

## PAN-150172

Fixed an issue where dataplane processes restarted when attempting to access websites that had the `NotBefore` attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.

## PAN-150170

```caveat
and PAN-149822
```

A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)).

## PAN-150013

```caveat
and PAN-149822
```

A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)).

## PAN-149813

Fixed an issue where the reply to an XML API call from Panorama was in a different format after upgrading to PAN-OS 8.1.14-h1 and later releases, which caused automated systems to fail the API call.

## PAN-149325

Fixed an issue on Panorama where the web interface took more time than expected to load changes when the virtual router was large or when there was a large configuration change request from the web interface.

## PAN-149005

Fixed an issue where XML API failed to fetch logs larger than 10MB.

## PAN-148806

A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted ([CVE-2020-2039](https://security.paloaltonetworks.com/CVE-2020-2039)).

## PAN-148676

Fixed an issue where the `panlogs` directory reached 100% utilization on the firewall due to early calculation of the .size file.

## PAN-148522

Fixed an issue for PAN-DB where certain situations caused performance issues.

## PAN-147424

Fixed an issue with internal buffer and file sizes where logs were discarded due to slow log purging when the incoming log rate was high.

## PAN-147258

Fixed an issue with one-way audio for inbound voice calls due to incorrect source port translation.

## PAN-147203

Fixed an issue where API calls did not return the output for the operational command for running configurations.

## PAN-146878

Fixed an issue where TCP traffic dropped due to TCP sequence checking in a high availability (HA) active/active configuration where traffic was asymmetric.

## PAN-146837

A fix was made to address a vulnerability involving information exposure through log files where sensitive fields were recorded in the configuration log without masking on PAN-OS software when the `after-change-detail` custom syslog field was enabled for configuration logs and the sensitive field appeared multiple times in one log entry. The first instance of the sensitive field was masked but subsequent instances were left in clear text ([CVE-2020-2043](https://security.paloaltonetworks.com/CVE-2020-2043)).

## PAN-145942

After upgrading to certain PAN-OS 8.1 and 9.0 versions, for certain configurations using dynamic routing without graceful restart and with Bidirectional Forwarding Detection (BFD) enabled, there was a longer traffic hit after an HA failover compared to previous versions. This was due to BFD incorrectly timing admin-down messages for the failover event.

## PAN-145929

Fixed an issue where, after upgrading the passive firewall, the stream control transmission protocol (SCTP) sessions synced from the active firewall did not retain the rule information, and, after failover, SCTP stateful inspection did not work.

## PAN-145422

Fixed an issue where a process (all_pktproc) restarted while processing SSL VPN sessions.

## PAN-145302

Fixed an issue where the HA peer device did not preserve its import configuration when the mode was active/active and VR sync was disabled.

## PAN-144804

Fixed an issue where the firewall generated GPRS tunneling protocol (GTP) logs for invalid GTP packets. This fix also implements a counter, `flow_gtp_invalid_ver`, where the invalid packets are counted.

## PAN-144232

Fixed an issue where, when any change was made to an authentication profile, the LDAP server or local user database in a shared context removed the user group mapping information from the firewall.

## PAN-143686

Fixed an issue where a firewall running in FIPS mode was unable to download the GlobalProtect datafile even when a GlobalProtect license was installed and valid.

## PAN-143493

Fixed an memory issue associated with a process (mgmtsrvr) due to a large number of ACK packets in logs on Panorama or the log collector.

## PAN-142927

Fixed an issue where the locked users list grew too large, which caused 100% CPU usage on a process (authd). With this fix, locked users will be purged hourly if the lockout time for that user has expired.

## PAN-142853

Fixed an issue on Panorama where commits failed, referring to a portion of the configuration that was not changed.

## PAN-142674

Fixed an issue where a process (brdagent) failed in an HA configuration using High Speed Chassis Interconnect (HSCI) ports due to a memory leak.

## PAN-142302

Fixed an issue where the firewalls faced connection issues with Cortex Data Lake.

## PAN-141239

Fixed an issue where dataplane free memory was depleted, which affected new GlobalProtect connections to the firewall.

## PAN-140982

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where a process (mprelay) on the control plane was restarted due to an internal heartbeat miss.

## PAN-140494

Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter, `pkt_recv_bad_group`, is incremented.

## PAN-140373

```caveat
PA-5250, PA-5260, and PA-5280 firewalls only
```

Fixed an issue where, when you deployed the firewall in a network that used Dynamic IP and Port (DIPP) NAT translation with PPTP, the generic routing encapsulation (GRE) packet in the PPTP connection from the server was sent back to its ingress interface in some connections.

## PAN-139764

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.

## PAN-139172

Fixed an issue where response pages generated from the firewall used the SMAC and DMAC addresses from the original packet, which caused a MAC flap on connected switches.

## PAN-138037

Fixed an issue where the host information profile (HIP) match message was automatically enabled when modifying the GlobalProtect Agent settings.

## PAN-137639

Fixed an issue where the log export query was slower than expected when exporting one million lines of logs.

## PAN-137138

Fixed an issue where a process (configd) consistently restarted with the following error message: `virtual memory limit exceeded, restarting` due to a dynamic updates push from Panorama to multiple firewalls.

## PAN-136957

Fixed an issue where access was denied if a password contained more than 63 characters.

## PAN-136844

Fixed an issue for S11 traffic where if the Modify Bearer Request message came after 30 seconds of Create Session Response message, the firewall dropped the Modify Bearer Request packet. This fix increases this time to 90 seconds.

## PAN-136726

Fixed an issue on the firewall where the dataplane pan-task process (all_pktproc) stopped responding while inspecting Server Message Block (SMB) traffic.

## PAN-136623

Fixed an issue where a process (useridd) failed due to internal user groups that were loading from the disk taking over the lock.

## PAN-136304

Fixed an issue where clientless VPN rewrite failed due to incorrect parsing of the HTML webpage.

## PAN-135418

Fixed an issue on the firewall where configuring uppercase **User Domain** values in authentication profiles led to a failure in GlobalProtect Agent configuration selection based on the domain user match condition.

## PAN-135356

Fixed an issue where policies that contained objects did not display correctly when exported to CSV or PDF format.

## PAN-135262

A fix was made to address a vulnerability involving information exposure through log files where an administrator's password or other sensitive information was logged in cleartext while using the CLI in PAN-OS software. The `opcmdhistory.log` file was introduced to track operational command (op-command) usage but did not mask all sensitive information ([CVE-2020-2044](https://security.paloaltonetworks.com/CVE-2020-2044)).

## PAN-134624

```caveat
VM-Series firewalls only
```

Fixed an issue where the VLAN interface failed to obtain the MAC address when the interface was used as a DHCP relay agent.

## PAN-134488

Fixed an issue where a process (all_pktproc) restarted while processing Clientless VPN traffic.

## PAN-133880

Fixed an issue where RADIUS authentication failed due to an FQDN resolution failure after the VM-Series firewall rebooted.

## PAN-131973

Fixed an issue where both firewalls in an HA active/passive configuration stopped responding at the same time.

## PAN-130564

Fixed an issue where the session ID did not display correctly in the debug logs related to the hardware security module (HSM).

## PAN-130168

Fixed an issue where a process (pan_comm) stopped responding due to operation commands run during a commit.

## PAN-129461

Fixed an issue where excessive next hop FPGA exceptions occurred when an ARP request or response was lost in the network in an ECMP configuration, which blocked subsequent ARP learning due to a full queue.

## PAN-129277

Enhanced a daemon (dnsproxy) to support DNS compression for query strings.

## PAN-128761

A fix was made to address an OS command injection vulnerability in the PAN-OS management interface that allowed authenticated administrators to execute arbitrary OS commands with root privileges ([CVE-2020-2037](https://security.paloaltonetworks.com/CVE-2020-2037)).

## PAN-125466

Fixed an issue where, during Antivirus or Threat Content update downloads or install, some show commands in the CLI, API calls, and web interface pages gave information output with significant delay (15-60 seconds).

## PAN-123279

Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.

## PAN-118098

Fixed an issue where a process (useridd) restarted while updating user groups. This issue occurred when multiple group mapping profiles were used to fetch the same group information while using different domain override settings.

## PAN-116720

A fix was made to address a reflected cross-site scripting (XSS) vulnerability in the PAN-OS management web interface where, if a remote attacker was able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link, the attacker could execute arbitrary code JavaScript code in the administrator's browser and perform administrative actions ([CVE-2020-2036](https://security.paloaltonetworks.com/CVE-2020-2036)).

## PAN-112539

Fixed an issue where the firewall stopped forwarding logs to the log collector from the Log Processing Card (LPC) after a commit push from Panorama due to a race condition.

## PAN-100757

Fixed an issue where the TCP timestamp was stripped from the Client Hello when SSL Forward Proxy decryption was enabled.

## PAN-93184

Fixed an intermittent issue where the firewall reported `Validation of Local client certificate failed resulting in error 58, Problem with the local SSL certificate` in the system log due to management plane out-of-memory errors when a process (varrcvr) attempted to register to the cloud.

## PAN-84211

In accordance with the latest NIST Revision, PAN-OS FIPS-CC mode releases prior to 9.0 used unsupported ciphers within the UserID Agent connections. With this fix, we removed all the cipher combinations, TLS server, and TLS clients in PAN-OS 8.0.5-h1 and later releases for FIPS-CC mode of operation to meet recent NIAP requirement and policy.
