--- type: Addressed product: PAN-OS version: 9.0.10 --- ## PAN-152699 Fixed an issue where the firewall added a redundant 0\r\n packet while processing Clientless VPN traffic. ## PAN-151197 Fixed an issue where a process (authd) restarted when an administrator authenticated to the firewall with an Active Directory (AD) account. This issue occurred when LDAP was configured with FQDN, used DHCP instead of a static management IP address, and used the management interface to connect to the LDAP server. ## PAN-150172 Fixed an issue where dataplane processes restarted when attempting to access websites that had the NotBefore attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled. ## PAN-150170 ```caveat and PAN-149822 ``` A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)). ## PAN-150013 ```caveat and PAN-149822 ``` A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges ([CVE-2020-2000](https://security.paloaltonetworks.com/CVE-2020-2000)). ## PAN-149839 ```caveat PA-7000 Series firewalls only ``` Added CLI commands to enable/disable resource-control groups and CLI commands to set an upper memory limit of 8G on a process (mgmtsrvr). To enable resource-control groups, use debug software resource-control enable and to disable them, use debug software resource-control disable. To set the memory limit, use debug management-server limit-memory enable, and to remove the limit, use debug management-server limit-memory disable. For the memory limit change to take effect, the firewall must be rebooted. ## PAN-149813 Fixed an issue where the reply to an XML API call from Panorama was in a different format after upgrading to PAN-OS 8.1.14-h1 and later releases, which caused automated systems to fail the API call. ## PAN-149325 Fixed an issue on Panorama where the web interface took more time than expected to load changes when the virtual router was large or when there was a large configuration change request from the web interface. ## PAN-149005 Fixed an issue where XML API failed to fetch logs larger than 10MB. ## PAN-148806 A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted ([CVE-2020-2039](https://security.paloaltonetworks.com/CVE-2020-2039)). ## PAN-148676 Fixed an issue where the panlogs directory reached 100% utilization on the firewall due to early calculation of the .size file. ## PAN-148522 Fixed an issue for PAN-DB where certain situations caused performance issues. ## PAN-147996 ```caveat PA-7000b Series firewalls only ``` Fixed a buffer overflow issue. ## PAN-147424 Fixed an issue with internal buffer and file sizes where logs were discarded due to slow log purging when the incoming log rate was high. ## PAN-147399 Fixed an issue where Panorama in Legacy mode rebooted due to multiple process (reportd) restarts. ## PAN-147258 Fixed an issue with one-way audio for inbound voice calls due to incorrect source port translation. ## PAN-147203 Fixed an issue where API calls did not return the output for the operational command for running configurations. ## PAN-146837 A fix was made to address a vulnerability involving information exposure through log files where sensitive fields were recorded in the configuration log without masking on PAN-OS software when the after-change-detail custom syslog field was enabled for configuration logs and the sensitive field appeared multiple times in one log entry. The first instance of the sensitive field was masked but subsequent instances were left in clear text ([CVE-2020-2043](https://security.paloaltonetworks.com/CVE-2020-2043)). ## PAN-146624 Fixed an issue where exporting logs from the web interface did not generate a system log entry. ## PAN-145942 After upgrading to certain PAN-OS 8.1 and 9.0 versions, for certain configurations using dynamic routing without graceful restart and with Bidirectional Forwarding Detection (BFD) enabled, there was a longer traffic hit after a high availability (HA) failover compared to previous versions. This was due to BFD incorrectly timing admin-down messages for the failover event. ## PAN-145929 Fixed an issue where, after upgrading the passive firewall, the stream control transmission protocol (SCTP) sessions synced from the active firewall did not retain the rule information, and, after failover, SCTP stateful inspection did not work. ## PAN-145507 Fixed an issue on the firewalls where traffic originating from a GlobalProtect user did not match host information profile (HIP) based Security policies using the cached HIP report. Instead, the traffic was denied until the GlobalProtect agent submitted a new HIP report about 20 seconds later. ## PAN-145422 Fixed an issue where a process (all_pktproc) restarted while processing SSL VPN sessions. ## PAN-145305 Fixed an issue where an inconsistent PAN-DB cloud connection caused the firewall to negotiate the incorrect version and decode the cloud responses with the incorrect format. ## PAN-145302 Fixed an issue where the HA peer device did not preserve its import configuration when the mode was active/active and VR sync was disabled. ## PAN-145142 Fixed an issue where Panorama running 9.0.8 allowed a user with the admin role Device Group and Template to create templates and template stacks. ## PAN-145041 Fixed an issue on the firewalls where a process (all_task) stopped responding. ## PAN-144804 Fixed an issue where the firewall generated GPRS tunneling protocol (GTP) logs for invalid GTP packets. This fix also implements a counter, flow_gtp_invalid_ver, where the invalid packets are counted. ## PAN-144670 Fixed an issue where the multi-factor authentication (MFA) timestamp was not redistributed across the virtual system (vsys) when the IP address-to-user mapping type was UIA. ## PAN-144613 Fixed an issue where, when previewing device group configurations from Panorama, the following error message was returned: Parameter device group missing. ## PAN-144492 Fixed an issue where traffic matched an incorrect URL filtering profile due to a similarity in the MD5 hashes between the URL filtering profiles. ## PAN-144232 Fixed an issue where, when any change was made to an authentication profile, the LDAP server or local user database in a shared context removed the user group mapping information from the firewall. ## PAN-143686 Fixed an issue where a firewall running in FIPS mode was unable to download the GlobalProtect datafile even when a GlobalProtect license was installed and valid. ## PAN-143644 Fixed an issue in multi-vsys firewalls where traffic did not match an FQDN address group based policy. ## PAN-143493 Fixed an memory issue associated with a process (mgmtsrvr) due to a large number of ACK packets in logs on Panorama or the log collector. ## PAN-143442 Fixed an issue where Amazon Web Services (AWS) Nitro System based VM-Series firewalls unexpectedly rebooted due to input/output (I/O) errors caused by improper NMVE I/O timeout settings. ## PAN-142927 Fixed an issue where the locked users list grew too large, which caused 100% CPU usage on a process (authd). With this fix, locked users will be purged hourly if the lockout time for that user has expired. ## PAN-142853 Fixed an issue on Panorama where commits failed, referring to a portion of the configuration that was not changed. ## PAN-142674 Fixed an issue where a process (brdagent) failed in an HA configuration using High Speed Chassis Interconnect (HSCI) ports due to a memory leak. ## PAN-142363 Fixed an issue where a process (*mprelay*) stopped responding and invoked an out-of-memory (OOM) killer condition and displayed the following error messages: `tcam full` and `pan_plfm_fe_cp_arp_delete`. ## PAN-142302 Fixed an issue where the firewalls faced connection issues with Cortex Data Lake. ## PAN-142089 Fixed an internal logging issue for a daemon (authd). ## PAN-141844 Fixed an issue where promiscuous VLAN mode did not work with the new host drivers being used on the ESXi and single-root input/output virtualization (SR-IOV) with VLAN tagging did not work as expected. Both Data Plane Development Kit and packet mmap mode did not work. ## PAN-141239 Fixed an issue where dataplane free memory was depleted, which affected new GlobalProtect connections to the firewall. ## PAN-141221 Fixed an issue where a commit or content update operation with an error was not prevented from executing in the dataplane, which caused corruption in the dataplane policy cache. ## PAN-141099 Fixed an issue where the HTTP/2 stream method was no longer valid after overloading the same pointer to point to either the HTTP/2 stream or the proxy flow. ## PAN-140982 ```caveat PA-7000 Series firewalls only ``` Fixed an issue where a process (mprelay) on the control plane was restarted due to an internal heartbeat miss. ## PAN-140747 Fixed an issue where the firewall failed to establish SFTP firewall-server connections when SSH decryption was enabled. ## PAN-140389 Fixed an issue on Panorama in Legacy mode where configuring Network File System (NFS) log storage (**Device > Setup > Operations**) caused all plugin installations to fail. ## PAN-140375 Fixed an issue where a process (logrcvr) exited due to a race condition. ## PAN-139365 ```caveat PA-7000 Series firewalls only ``` Enhanced latency-sensitive protocols processing. With this fix, the following latency-sensitive control traffic will be prioritized: BGP, BFD, LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM), and Internet Group Management Protocol (IGMP). ## PAN-139264 Fixed an issue where the Elasticsearch cluster status displayed in yellow due to a missing replica serial number. ## PAN-139172 Fixed an issue where response pages generated from the firewall used the SMAC and DMAC addresses from the original packet, which caused a MAC flap on connected switches. ## PAN-138584 Fixed an issue that prevented the addition of a secondary logging disk for a VM-Series firewall deployed on AWS using Nitro server instance types. ## PAN-138037 Fixed an issue where the host information profile (HIP) match message was automatically enabled when modifying the GlobalProtect Agent settings. ## PAN-138034 Fixed an issue where virtual machine (VM) information source Dynamic Address Groups overrode static address groups, which caused traffic to hit the wrong Security policy rule. ## PAN-137885 ```caveat VM-Series firewalls in Microsoft Azure environment only ``` Fixed an issue where a firewall with accelerated networking enabled was unable to process packets efficiently because of underlying Microsoft drivers. To leverage this fix, you must upgrade to VM-Series Plugin 1.0.12. ## PAN-137656 Fixed an issue where the show config diff CLI command did not work correctly and produced unexpected output. ## PAN-136957 Fixed an issue where access was denied if a password contained more than 63 characters. ## PAN-136950 Fixed an issue where, on a firewall managed by Panorama, the XML API based IP tags were lost after a firewall reboot or process (**useridd**) restart. ## PAN-136844 Fixed an issue for S11 traffic where if the Modify Bearer Request message came after 30 seconds of Create Session Response message, the firewall dropped the Modify Bearer Request packet. This fix increases this time to 90 seconds. ## PAN-136726 Fixed an issue on the firewall where the dataplane pan-task process (all_pktproc) stopped responding while inspecting Server Message Block (SMB) traffic. ## PAN-136623 Fixed an issue where a process (useridd) failed due to internal user groups that were loading from the disk taking over the lock. ## PAN-136304 Fixed an issue where clientless VPN rewrite failed due to incorrect parsing of the HTML webpage. ## PAN-135946 Fixed an intermittent issue where Panorama was unable to query logs from the log collector due to large file sizes in es_cache_cron.log. ## PAN-135547 Fixed an issue on Panorama where administrators were unable to delete a shared address object even when it was not referenced in the configuration. ## PAN-135418 Fixed an issue on the firewall where configuring uppercase **User Domain** values in authentication profiles led to a failure in GlobalProtect Agent configuration selection based on the domain user match condition. ## PAN-135356 Fixed an issue where policies that contained objects did not display correctly when exported to CSV or PDF format. ## PAN-135354 Fixed an issue where the paths between the control plane and the dataplanes in network processing cards (NPCs) stalled in the dataplane-to-control plane direction due to the Ring Descriptor entries becoming out of sync on each side. This produced unrecoverable data path monitoring failures, which caused the chassis to become nonfunctional. ## PAN-135321 Fixed an issue where all NAT rules using the same FQDN entries as translated IP addresses were not updated when the IP addresses changed for those FQDNs. ## PAN-135262 A fix was made to address a vulnerability involving information exposure through log files where an administrator's password or other sensitive information was logged in cleartext while using the CLI in PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information ([CVE-2020-2044](https://security.paloaltonetworks.com/CVE-2020-2044)). ## PAN-135158 Fixed an issue where setting an IPv6 destination filter for the packet-diag option returned an error regarding a character limit. ## PAN-135134 Fixed an issue where using a session_proxy() without checking that it actually is a proxy led to a dataplane process restart. ## PAN-134981 Fixed an issue with a memory leak in a process (user-id) due to failed LDAP over SSL (LDAPS) requests. ## PAN-134810 Fixed an issue where **Resolve (Objects > Addresses > )** in the web interface did not work for FQDN address objects with more than 63 characters. ## PAN-134714 Fixed an issue where Safe Search was not enabled after an application change. ## PAN-134624 ```caveat VM-Series firewalls only ``` Fixed an issue where the VLAN interface failed to obtain the MAC address when the interface was used as a DHCP relay agent. ## PAN-134488 Fixed an issue where a process (all_pktproc) restarted while processing Clientless VPN traffic. ## PAN-134038 Fixed an issue where custom signatures did not properly detect the User-Agent header when the Origin header was above the User-Agent header. ## PAN-133915 Fixed an issue on Panorama where configuring a BGP import rule from the CLI failed with the following error message: Server error : permission denied for the command set. ## PAN-133912 Fixed an issue where querying traffic logs based on address objects and address groups did not work. ## PAN-133880 Fixed an issue where RADIUS authentication failed due to an FQDN resolution failure after the VM-Series firewall rebooted. ## PAN-133673 Fixed an issue that caused a procses (ikemgr) to exit when site-to-site VPNs experienced connectivity interruptions. ## PAN-133609 Fixed an issue where the Authentication Portal did not work due to a large number of HTTP requests with unsupported Authorization headers. ## PAN-133285 Fixed an issue on the firewalls where configuring a default Online Certificate Status Protocol (OCSP) URL in front of an intermediate certificate authority (CA) in a certificate profile did not override the OCSP URL during the validation of client certificates issued by the intermediate CA. ## PAN-132922 Fixed an issue where service objects were unable to be deleted if they were configured to exceed firewall limits. ## PAN-132715 Fixed an issue where a child dynamic address group was not added as a member of the parent group. ## PAN-132697 Fixed an issue where the GlobalProtect portal did not generate certificate signing requests (CSRs) due to failed Simple Certificate Enrollment Protocol (SCEP) authentication cookie validation. ## PAN-131973 Fixed an issue where both firewalls in an HA active/passive configuration stopped responding at the same time. ## PAN-131814 Fixed an issue where the firewall did not recognize a device when the DHCP contained a hostname with a trailing NULL. ## PAN-131491 Fixed an issue where the **ACC** risk meter displayed as zero for long time periods with a large amount of logs. ## PAN-131045 Fixed an issue where a rare cleartext HTTP/2 application behavior caused a resource leak. If jumbo frames were enabled, this leak caused the App-ID queue to fill up quickly, which led to legitimate sessions being discarded. ## PAN-130564 Fixed an issue where the session ID did not display correctly in the debug logs related to the hardware security module (HSM). ## PAN-130562 Fixed an issue where, in VM-Series firewalls deployed using init-cfg.txt in the bootstrap process and set in an HA configuration, the configuration did not display as synchronized due to the initcfg configuration. ## PAN-130168 Fixed an issue where a process (pan_comm) stopped responding due to operation commands run during a commit. ## PAN-129474 Fixed an issue where a process (mgmtsrvr) restarted due to race conditions initialized by the mutex. ## PAN-129461 Fixed an issue where excessive next hop FPGA exceptions occurred when an ARP request or response was lost in the network in an ECMP configuration, which blocked subsequent ARP learning due to a full queue. ## PAN-129294 Fixed an issue on Panorama where the **Policy Optimizer** showed invalid data for **Rule Usage**. ## PAN-129277 Enhanced a daemon (dnsproxy) to support DNS compression for query strings. ## PAN-128761 A fix was made to address an OS command injection vulnerability in the PAN-OS management interface that allowed authenticated administrators to execute arbitrary OS commands with root privileges ([CVE-2020-2037](https://security.paloaltonetworks.com/CVE-2020-2037)). ## PAN-128650 Fixed an issue where selecting **Preview Changes** under a specific device group resulted in the following error message: Parameter device group missing. ## PAN-128042 Fixed an issue where the dynamic address group failed due to a process (devsrvr) not being synced with another process (useridd). ## PAN-127691 Fixed an issue where the dataplane maintained the old category for the URL even after changing or deleting that category from PAN-DB. ## PAN-126938 Fixed an issue where multiple daemons restarted due to MP ARP overflow. ## PAN-126353 Fixed an issue where the XML API used to retrieve hardware status periodically failed with a 200 OK message and no data. ## PAN-120530 Fixed an issue where a Panorama appliance running PAN-OS 10.0.0 observed restarts in a process (reportd) while running a custom report when the log collector or remote device was running a software version earlier than the current version on Panorama. ## PAN-120249 Fixed an issue where Elasticsearch failed to properly start up, which caused issues with logging on Panorama or the Log Collector. ## PAN-118468 ```caveat VM-Series firewalls on VMware ESXi only ``` Fixed an issue where the firewall stays in a boot loop and enters maintenance mode after adding a 60GB disk. ## PAN-118416 ```caveat Japanese language only ``` Fixed an issue where the **WildFire Update Schedule** incorrectly displayed At as Atlantic. ## PAN-116843 Fixed an issue on Panorama where, when navigating through **Policies**, the following error message displayed: show rule hit count op-command failed. ## PAN-115954 Fixed an issue where commits failed with the following error: Error unserializing profile objects failed to handle CONFIG_UPDATE_START. ## PAN-113523 Fixed an intermittent issue where configuration audit stopped showing commit history and revisions. ## PAN-112539 Fixed an issue where the firewall stopped forwarding logs to the log collector from the Log Processing Card (LPC) after a commit push from Panorama due to a race condition. ## PAN-112246 Fixed an issue on the firewalls where a process (mgmtsrvr) restarted after the Panorama connection flapped. ## PAN-101484 A fix was made to address an OS command injection vulnerability in the PAN-OS management interface that allowed authenticated administrators to execute arbitrary OS commands with root privileges ([CVE-2020-2038](https://security.paloaltonetworks.com/CVE-2020-2038)).