---
type: Addressed
product: PAN-OS
version: 9.0.9
---

## WF500-5320

Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.

## PAN-148988

A fix was made to address a Security Assertion Markup Language (SAML) authentication issue ([CVE-2020-2021](https://security.paloaltonetworks.com/CVE-2020-2021)).

## PAN-148068

Fixed an issue where SSL connections were blocked if you enabled decryption with the option to block sessions that have expired certificates. This issue included servers that sent an expired AddTrust certificate authority (CA) in the certificate chain.

## PAN-145195

```caveat
and PAN-145149
```

A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface ([CVE-2020-2040](https://security.paloaltonetworks.com/CVE-2020-2040)).

## PAN-145151

```caveat
and PAN-145149
```

A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface ([CVE-2020-2040](https://security.paloaltonetworks.com/CVE-2020-2040)).

## PAN-145150

```caveat
and PAN-145149
```

A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface ([CVE-2020-2040](https://security.paloaltonetworks.com/CVE-2020-2040)).

## PAN-145026

Fixed an issue where Cortex Data Lake certificates on the firewall were not automatically renewed after the certificates expired.

## PAN-144882

Fixed an issue where the firewall generated critical system logs: Fsck failed for Logging Raid Disk Pair after downgrading from PAN-OS 9.0 to PAN-OS 8.1.

## PAN-144782

Fixed an issue where a configuration audit created a large number of opresult.out files, which filled up the session/pan/user_tmp directory in opt/pancfg. This caused a slow Panorama response until a device restart was performed or the files were manually deleted from the root of the device.

## PAN-144646

Fixed an issue where a process (varrcvr) stopped responding on the PA-7000 Series Log Forwarding Card (LFC) when it received a verdict from the WildFire cloud.

## PAN-143957

Fixed an issue where, after loading a saved configuration snapshot by API, a custom role-based administrator required Superuser privileges to perform a full commit.

## PAN-143648

```caveat
VM-Series firewalls in Azure environment only
```

Fixed an issue where a kernel panic in a Linux Integration Services (LIS) driver caused the firewall to reboot by itself.

## PAN-141563

Fixed an issue where Slot 8 path monitoring failure occurred due to a memory buildup in a process (logrcvr) that was caused by slow communication and connection between log forwarding and Cortex Data Lake.

## PAN-140846

Fixed an issue where the dataplane restarted during a commit when **Netflow** was enabled.

## PAN-140494

Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter, pkt_recv_bad_group, is incremented.

## PAN-140465

```caveat
VM-Series firewalls only
```

Fixed connection issues between IPv6 peers when the IPv6 neighbor cache was synchronized in an HA cluster where, after failover, the newly active firewall did not send multicast neighbor solicitation from its global unicast address.

## PAN-140386

Fixed an intermittent issue where the firewall used IP addresses instead of domain names for URL category lookup after upgrading to 9.0.6.

## PAN-139935

Fixed an issue in the URL process where a process (devsrvr) stopped responding.

## PAN-139764

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.

## PAN-139718

Fixed an issue where the firewall failed stateful inspection for GTP forward relocation requests greater than 1,500 bytes and could not parse Access Point Name (APN) information in forward relocation requests.

## PAN-139587

```caveat
PA-5200 Series and PA-7000 Series firewalls only
```

Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.

## PAN-139391

Fixed an issue where unique GlobalProtect portal profiles were not selected in the correct order.

## PAN-138870

Fixed an issue where a process (configd) restarted and administrators received one of the following error messages: Timed out while getting config lock. Please try again or Please wait while the server reboots... due to a database error.

## PAN-138813

Fixed a performance drop issue seen when using API to configure larger sets of objects (more than 25 objects).

## PAN-138739

Fixed an issue where, in a high availability (HA) active/active configuration in a virtual wire deployment with asymmetric traffic, decryption did not work for some sites.

## PAN-138476

Fixed an intermittent issue where logs were delayed or missing when querying for logs by applying filters. To leverage this fix, you must upgrade Panorama to 9.0.9 and the Cloud Services plugin to 1.6.0-h1.

## PAN-137966

Fixed a configuration lock issue where Panorama timed out due to a process (configd) being unable to read another process (mongod).

## PAN-137902

```caveat
PA-7000 Series firewalls only
```

Fixed an issue where hot swapping a PA-7000 100G NPC with a PA-7000 20G NPC caused packet buffer leak and slot restarts.

## PAN-137867

```caveat
PA-7000 Series firewalls only, running with both a PA-7000 100G NPC and a PA-7000 20G NPC
```

Fixed an issue where IPSec traffic caused dataplane restarts.

## PAN-137387

Fixed an issue where URL filtering used the IP address instead of the hostname, which led to incorrect URL categorization.

## PAN-137138

Fixed an issue where a process (configd) consistently restarted with the following error message: virtual memory limit exceeded, restarting due to a dynamic updates push from Panorama to multiple firewalls.

## PAN-136703

```caveat
PA-3000 Series and PA-800 Series firewalls only
```

Fixed an issue with insufficient memory allocation for configurations to accommodate the PAN-OS 9.0 Dynamic Address Group feature.

## PAN-136649

Fixed an issue where PA-7000 20GXM and PA-7000 20GQXM Network Processing Cards (NPCs) failed to process some sessions for Layer 7 inspection due to internal maximum threshold value that was not set.

## PAN-136608

Fixed an issue in Panorama where the Security policy **Target** displayed the serial number of the targeted device instead of the hostname.

## PAN-136390

```caveat
PA-7000 Series with 100GB NPC only
```

Fixed an issue during firewall bootup where the following error message: Bootloader upgrade failed, ret 255 appeared when small form-factor pluggable (SFP) modules were installed.

## PAN-135865

Fixed an issue that prevented Panorama from being switched out of management-only mode when deployed in Amazon Web Services (AWS) instance types M5 and C5.

## PAN-135684

Fixed an issue with log collectors on Panorama where large index sizes caused higher CPU usage than expected when disk space usage was high.

## PAN-135587

Fixed an issue where the GlobalProtect gateway was unable to parse a large list of IP addresses assigned on a local machine.

## PAN-135039

Fixed an issue in Panorama where a memory leak occurred during an HA sync commit.

## PAN-134309

Fixed an issue where a process (devsrvr) restarted when it hit the limit of the number of custom patterns available in the allocated memory.

## PAN-133731

Fixed an issue on the Panorama Virtual Appliance where the show interface all CLI command did not list any output.

## PAN-133727

Fixed an issue where Session Initiation Protocol (SIP) messages were not parsed correctly when the packet was received in separate segments, which caused the receiver to receive corrupted messages.

## PAN-133614

Fixed an issue on the Panorama Virtual Appliance where SNMP Object IDs (OIDs) were missing for interfaces other than the **Management** interface.

## PAN-133495

Fixed an issue where the Terminal Server (TS) Agent disconnected on the firewall after a failover or reboot.

## PAN-133411

Fixed an issue where after making configuration changes and selecting **Preview Changes**, a 500 Internal Server Error message displayed due to a memory leak.

## PAN-133211

Fixed an issue where the policy order was not maintained when moved to a different device group.

## PAN-132995

```caveat
PA-7000 Series and PA-3200 Series firewalls only
```

Fixed an issue where when jumbo frames were enabled, the maximum transmission unit (MTU) size limit was lower than expected.

## PAN-132766

Fixed an issue in Panorama where custom region objects were not visible in the GlobalProtect Portal **External Gateway** drop-down.

## PAN-132712

Fixed an issue where scheduled reports did not run on a PA-7000 Series firewall not managed by Panorama after upgrade to 8.1.10 or 9.0.4 and later versions.

## PAN-132476

Made improvements to the log storage for VM-Series for NSX Panorama.

## PAN-131945

Fixed an issue where **Device > VM-Series** on the firewall web interface showed a blank screen.

## PAN-131792

Fixed an issue where the **Name** log filter (**Monitor > Logs > Traffic**) was not maintained when viewing the **Log Viewer** for a Security policy rule (**Policies > Security**) from the drop-down.

## PAN-131501

Fixed an issue when configuring Clientless VPN and executing the portal-getconfig CLI command where user groups were retrieved but were not freed, which caused a memory leak on a process (sslvpn).

## PAN-131290

Fixed an issue where reports from Panorama displayed the following messages: Please wait... and Warning: Some of the devices are in High Speed Log Forwarding Mode.

## PAN-131038

Fixed an issue on the firewalls where the FIB lookup routing test did not display all available paths on the web interface.

## PAN-130870

Fixed an issue where the management plane CPU on the firewall was high due to index generation on summary logs.

## PAN-130776

Fixed an issue on Panorama where Applications and Threats content update deployment failed due to the content version date check.

## PAN-130558

Fixed an issue on the firewalls where SNMP queries for panZoneTable listed details for only one zone when there were two zones with same names under different virtual systems.

## PAN-130121

Fixed an issue in Amazon Web Services (AWS) where Ethernet1/1 failed DHCP renewal after the hour.

## PAN-129281

Fixed an issue where a process (useridd) restarted due to a buffer overflow when the time-to-live (TTL) and **Idle Timeout** values were set to **Never**, a timing issue between user group context and a process (sysd) callback, and a group mapping issue when multiple group mappings fetched the same groups with different override domains.

## PAN-128879

Fixed an issue where the PAN-OS XML API inject was not working for IP address to user mappings or for the import of software, content, and plugins.

## PAN-128393

Fixed an issue where User-ID running on port 5007 responded with the default certificate and participated in mutual authentication after upgrading to PAN-OS 9.0, which exposed the default certificate on the firewall to third-party vulnerability scanners.

## PAN-128155

Fixed an issue where system log entries misspelled "client version" as "lient version", which made it difficult for syslog servers to find these entries.

## PAN-128078

Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled.

## PAN-127434

Fixed an issue where reports for URLs were not generating the correct data output.

## PAN-127375

Fixed an issue where a process (rasmgr) restarted multiple times, which caused the firewall to reboot.

## PAN-127260

Fixed an issue where the /opt/pancfg partition became full due to a large amount of botnet reports that were not automatically deleted.

## PAN-125524

Fixed an issue where the dataplane restarted when many NAT rules were followed by successive commits.

## PAN-125501

Fixed an issue where URL information in a URL **Custom Report** was blank when the report contained flexible size fields (such as **URL Category List**).

## PAN-125466

Fixed an issue where, during Antivirus or Threat Content update downloads or install, some show commands in the CLI, API calls, and web interface pages gave information output with significant delay (15-60 seconds).

## PAN-124916

Added two ciphers for GlobalProtect Portal TLS connections.

## PAN-123279

Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.

## PAN-123090

```caveat
PA-3000 Series firewalls only
```

Fixed an issue where a configuration commit failed due to a memory allocation failure on the dataplane.

## PAN-122226

Fixed an issue where traffic failed to match Security policies using wildcard address objects.

## PAN-121602

Fixed an issue on Panorama where a query (after-change-preview contains) did not return the expected results for configuration logs.

## PAN-120830

Fixed an issue in Panorama where certificate import failed with the following error message: Certificate chain cannot be validated, required CAs not found.

## PAN-120614

Fixed an issue where a commit from a Panorama appliance running PAN-OS 9.1 to a managed firewall running PAN-OS 9.0 or earlier failed with the following error message in ms.log: error generating tranform ike-pre-transform.xsl.

## PAN-120454

Fixed an issue where the firewall did not fail over to the secondary LDAP server when the primary LDAP server was not reachable and the configured LDAP bind timeout was not properly honored when SSL protocol was used.

## PAN-120113

Fixed an issue where the **to**, **from**, and **subject** fields did not populate in the threat logs if the fields were out of order.

## PAN-120105

Fixed an issue where email header information intermittently was not present in threat logs.

## PAN-119645

Fixed an issue where a process (panio) used unnecessary memory and caused an out-of-memory (OOM) condition on the dataplane if the dataplane was already low on memory.

## PAN-119170

Fixed an issue where Panorama did not display managed devices when selecting **Revert Content** (**Panorama > Device Deployment > Dynamic Updates**).

## PAN-119159

Fixed an issue where if one invalid FQDN object was configured, FQDN resolution failed for all FQDN objects.

## PAN-118098

Fixed an issue where a process (useridd) restarted while updating user groups. This issue occurred when multiple group mapping profiles were used to fetch the same group information while using different domain override settings.

## PAN-117606

Fixed an issue where a process (configd) crashed while making configuration changes on Panorama.

## PAN-117487

Fixed an issue where a process (mgmtsrvr) stopped responding due to a memory corruption issue when acquiring a configuration lock.

## PAN-117075

Fixed an issue where the firewall did not process the TLS record in SSL Inbound Inspection as expected, which introduced out-of-order packets in the transmit stage packet capture and affected client performance while accessing HTTP video applications.

## PAN-116835

Fixed an issue with log reading performance when using WMI for server monitoring with PAN-OS integrated User-ID agent.

## PAN-116720

A fix was made to address a reflected cross-site scripting (XSS) vulnerability in the PAN-OS management web interface where, if a remote attacker was able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link, the attacker could execute arbitrary code JavaScript code in the administrator's browser and perform administrative actions ([CVE-2020-2036](https://security.paloaltonetworks.com/CVE-2020-2036)).

## PAN-115914

Fixed an issue where Static, Connected, and Host routes were missing on the FIB table of the firewall in a passive state after 300 seconds of switch over.

## PAN-112120

Fixed an issue where threat **Name** field of a threat **Custom Report** displayed the threat ID instead of the threat name.

## PAN-111379

Fixed an issue on the firewall where the Application Command Center (ACC) **Network Activity** tab displayed the message In Progress and stopped responding.

## PAN-110457

Fixed an issue where Panorama ran out of memory due to high memory usage on a process (configd).

## PAN-106763

Fixed an issue where the dataplane crashed while freeing up memory due to a corrupted or long certificate field in the handshake.

## PAN-102202

Fixed an issue where the OSPF summary Link State Advertisement (LSA) for the default 0.0.0.0/0 route were not advertised by the Area Border Router (ABR).

## PAN-98933

Fixed an issue on an M-Series appliances in a high availability (HA) active/passive configuration where the schedules (*Device > Dynamic Updates*) were unresponsive after a failover or restart of Panorama.

## PAN-98694

Fixed an issue on a PA-5200 Series firewall in an HA active/passive configuration where the firewall dropped TCP-FIN packets after a failover.
