---
type: Addressed
product: PAN-OS
version: 9.1.4
---

## WF500-5320

Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.

## PAN-151197

Fixed an issue where a process (authd) restarted when an administrator authenticated to the firewall with an Active Directory (AD) account. This issue occurred when LDAP was configured with FQDN, used DHCP instead of a static management IP address, and used the management interface to connect to the LDAP server.

## PAN-150172

Fixed an issue where dataplane processes restarted when attempting to access websites that had the NotBefore attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.

## PAN-150170

```caveat
and PAN-149822
```

A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)).

## PAN-150013

```caveat
and PAN-149822
```

A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)).

## PAN-149377

A fix was made to address a vulnerability regarding information exposure through log files in PAN-OS that made it possible for configuration secrets for HTTP, email, and SNMP trap v3 log forwarding server profiles to be logged to the logrcvr.log system log ([CVE-2021-3032](https://security.paloaltonetworks.com/CVE-2021-3032)).

## PAN-148806

A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted ([CVE-2020-2039](https://security.paloaltonetworks.com/CVE-2020-2039)).

## PAN-148676

Fixed an issue where the panlogs directory reached 100% utilization on the firewall due to early calculation of the .size file.

## PAN-148522

Fixed an issue for PAN-DB where certain situations caused performance issues.

## PAN-147996

```caveat
PA-7000b Series firewalls only
```

Fixed a buffer overflow issue.

## PAN-147399

Fixed an issue where Panorama in Legacy mode rebooted due to multiple process (reportd) restarts.

## PAN-147258

Fixed an issue with one-way audio for inbound voice calls due to incorrect source port translation.

## PAN-147203

Fixed an issue where API calls did not return the output for the operational command for running configurations.

## PAN-146837

A fix was made to address a vulnerability involving information exposure through log files where sensitive fields were recorded in the configuration log without masking on PAN-OS software when the after-change-detail custom syslog field was enabled for configuration logs and the sensitive field appeared multiple times in one log entry. The first instance of the sensitive field was masked but subsequent instances were left in clear text ([CVE-2020-2043](https://security.paloaltonetworks.com/CVE-2020-2043)).

## PAN-146624

Fixed an issue where exporting logs from the web interface did not generate a system log entry.

## PAN-146531

Fixed an issue where conversion from Panorama mode to logger mode was enabled even when an admin user named admin did not exist in the configuration, which caused access to the appliance to be lost.

## PAN-146086

Fixed an issue for Amazon Web Services (AWS) types C5 and M5 where Panorama was unable to use NMVe storage.

## PAN-145942

After upgrading to certain PAN-OS 8.1 and 9.0 versions, for certain configurations using dynamic routing without graceful restart and with Bidirectional Forwarding Detection (BFD) enabled, there was a longer traffic hit after an HA failover compared to previous versions. This was due to BFD incorrectly timing admin-down messages for the failover event.

## PAN-145929

Fixed an issue where, after upgrading the passive firewall, the stream control transmission protocol (SCTP) sessions synced from the active firewall did not retain the rule information, and, after failover, SCTP stateful inspection did not work.

## PAN-145422

Fixed an issue where a process (all_pktproc) restarted while processing SSL VPN sessions.

## PAN-145302

Fixed an issue where the high availability (HA) peer device did not preserve its import configuration when the mode was active/active and VR sync was disabled.

## PAN-145142

Fixed an issue where Panorama running 9.0.8 allowed a user with the admin role Device Group and Template to create templates and template stacks.

## PAN-144882

Fixed an issue where the firewall generated critical system logs: Fsck failed for Logging Raid Disk Pair after downgrading from PAN-OS 9.0 to PAN-OS 8.1.

## PAN-144804

Fixed an issue where the firewall generated GPRS tunneling protocol (GTP) logs for invalid GTP packets. This fix also implements a counter, flow_gtp_invalid_ver, where the invalid packets are counted.

## PAN-144670

Fixed an issue where the multi-factor authentication (MFA) timestamp was not redistributed across the virtual system (vsys) when the IP address-to-user mapping type was UIA.

## PAN-144613

Fixed an issue where, when previewing device group configurations from Panorama, invalid messages were returned. With this fix, the configuration preview no longer returns invalid messages.

## PAN-144492

Fixed an issue where traffic matched an incorrect URL filtering profile due to a similarity in the MD5 hashes between the URL filtering profiles.

## PAN-143705

Fixed an issue where delicensing a large number of devices from Panorama failed.

## PAN-143686

Fixed an issue where a firewall running in FIPS mode was unable to download the GlobalProtect datafile even when a GlobalProtect license was installed and valid.

## PAN-143644

Fixed an issue where traffic did not match an FQDN address group based policy.

## PAN-143090

Fixed an issue where the firewall silently dropped TCP out-of-order packets.

## PAN-142927

Fixed an issue where the locked users list grew too large, which caused 100% CPU usage on a process (authd). With this fix, locked users will be purged hourly if the lockout time for that user has expired.

## PAN-142853

Fixed an issue on Panorama where commits failed, referring to a portion of the configuration that was not changed.

## PAN-142523

Fixed an issue where application-based SD-WAN policy match did not work if application traffic was subjected to SSL decryption.

## PAN-141515

Fixed an issue where a service object with a destination port that is pushed from Panorama displays as **[object Object]** on the firewall.

## PAN-141099

Fixed an issue where the HTTP/2 stream method was no longer valid after overloading the same pointer to point to either the HTTP/2 stream or the proxy flow.

## PAN-140747

Fixed an issue where the firewall failed to establish SFTP firewall-server connections when SSH decryption was enabled.

## PAN-140494

Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter, pkt_recv_bad_group, is incremented.

## PAN-140272

Fixed an issue where RADIUS authentication failed when using an ampersand (&) in the RADIUS shared secret.

## PAN-139764

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.

## PAN-139680

Fixed an issue where dynamic route updates triggered an unintentional refresh of the DHCP client interface IP address, which led to the removal and re-addition of the default route associated with the DHCP client IP address and caused traffic disruption.

## PAN-139587

```caveat
PA-5200 Series and PA-7000 Series firewalls only
```

Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.

## PAN-139365

```caveat
PA-7000 Series firewalls only
```

Enhanced latency-sensitive protocols processing. With this fix, the following latency-sensitive control traffic will be prioritized: BGP, Bidirectional Forwarding Detection (BFD), LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM), and Internet Group Management Protocol (IGMP).

## PAN-139264

Fixed an issue where the Elasticsearch cluster status displayed in yellow due to a missing replica serial number.

## PAN-139172

Fixed an issue where response pages generated from the firewall used the SMAC and DMAC addresses from the original packet, which caused a MAC flap on connected switches.

## PAN-138584

Fixed an issue that prevented the addition of a secondary logging disk for a VM-Series firewall deployed on Amazon Web Services (AWS) using Nitro server instance types.

## PAN-137770

Fixed an issue where the dataplane restarted due to a loop in DoS protection source-destination IP address classification.

## PAN-137661

Fixed an issue where certain packets destined to untagged subinterfaces were silently dropped on multi-dataplane platforms.

## PAN-137138

Fixed an issue where a process (configd) consistently restarted with the following error message: virtual memory limit exceeded, restarting due to a dynamic updates push from Panorama to multiple firewalls.

## PAN-136844

Fixed an issue for S11 traffic where if the Modify Bearer Request message came after 30 seconds of Create Session Response message, the firewall dropped the Modify Bearer Request packet. This fix increases this time to 90 seconds.

## PAN-136650

Fixed an issue where a Log Collector remained in an out-of-sync state after configuring an IP address (local or public) on an additional Ethernet interface.

## PAN-135889

Fixed an issue where GTP-U tunnel session was setup incorrectly on receiving Modify Bearer Requests/ Responses with multiple Bearer Context for different EBIs

## PAN-135887

Fixed an issue where the inner GTP-U flows were installed using incorrect zones, which led to traffic issues if the firewall was in line for the S1-U interface.

## PAN-135673

Fixed an issue where the firewall kept its connection to Cortex Data Lake even after the configuration had been disabled and the license was expired.

## PAN-135134

Fixed an issue where using a session_proxy() without checking that it actually is a proxy led to a dataplane process restart.

## PAN-134029

Fixed an intermittent issue on the firewall where H.225 VOIP signaling packets dropped.

## PAN-132285

Fixed an intermittent issue where a Security policy with **Send ICMP Unreachable** enabled for certain drop or reset sessions caused a process (all-pktproc) to restart.

## PAN-131474

A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where the connection details for a scheduled configuration export were logged in system logs ([CVE-2021-3037](https://security.paloaltonetworks.com/CVE-2021-3037)).

## PAN-129461

Fixed an issue where excessive next hop FPGA exceptions occurred when an ARP request or response was lost in the network in an ECMP configuration, which blocked subsequent ARP learning due to a full queue.

## PAN-128650

Fixed an issue where selecting **Preview Changes** under a specific device group resulted in the following error message: Parameter device group missing.

## PAN-123279

Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.

## PAN-115896

Fixed an issue where the static route path monitoring status was not viewable from the CLI or web interface and failed with the following error message: failed to execute op command.

## PAN-114761

Fixed an issue where the log receiver failed to establish connections to Cortex Data Lake when it was unable to validate Cortex Data Lake certificates.

## PAN-114264

Fixed an issue where sessions were offloaded as the application identification was performed when you configured a custom application with **Continue scanning for other application**.

## PAN-113767

Fixed an issue where the firewall silently dropped packets when security profiles were attached and FPGA enabled AHO and DFA.

## PAN-112972

Fixed an issue where scheduled reports were not generated as expected when you added groups in a query builder.

## PAN-111333

An enhancement was made to increase the pattern match limit to recognize applications and threats accurately.

## PAN-110685

Fixed a rare issue where an incorrect User-ID™ match to the respective LDAP group caused a security policy mismatch.

## PAN-109894

Fixed an issue where, when DHCP requests were sent from a subinterface configured as a DHCP client, packets dropped due to improper handling of the ARP reply for the DHCP requests.

## PAN-103865

Fixed an issue where the firewall did not detect user credentials when the number of users exceeded 60,000. To leverage this fix, you must upgrade Windows agents to User-ID agent <8.1.11 | 9.0.4> or a later User-ID agent <8.1 | 9.0> release.

## PAN-101484

A fix was made to address an OS command injection vulnerability in the PAN-OS management interface that allowed authenticated administrators to execute arbitrary OS commands with root privileges ([CVE-2020-2038](https://security.paloaltonetworks.com/CVE-2020-2038)).
