--- type: Addressed product: PAN-OS version: 8.1.8 --- ## WF500-5023 Fixed an issue on WF-500 appliances where the cluster service took longer than expected to start due to a large number of queued sample data. ## WF500-4974 Fixed an issue on WF-500 appliances where the static analysis results displayed in the PDF report but did not display in the WildFire® analysis summary of the web interface. ## WF500-4844 Fixed an issue on WildFire appliance clusters where the passive-controller responded with the incorrect Common Name (CN) in the certificate, which caused the registration to fail. ## WF500-4838 Fixed an intermittent issue on a WF-500 appliance where WildFire reports took longer than expected to generate, which caused the task to automatically timeout. ## WF500-4785 Fixed a rare issue on WF-500 appliances where the firewall did not respond after you upgraded the appliance from a PAN-OS® 8.0.1 release to a PAN-OS 8.0.10 or later release. With this fix, you can run the new `debug software raid fixup auto` CLI command to recover the RAID controller. ## WF500-4784 Fixed an issue on a WF-500 appliance where during a reboot, the following error message displayed: `FATAL: module nbd not found`. ## WF500-4743 Fixed an intermittent issue on a WF-500 appliance where the CLI command `debug wildfire reset global-database fix` stopped responding. ## PAN-116316 Fixed an issue where RTP and RTCP predict sessions failed, which caused RTSP based video streaming to stop processing. ## PAN-116084 Fixed a file descriptor issue that caused an interface on a VM-Series firewall on Azure to stop receiving traffic. ## PAN-114984 Fixed OpenSSL vulnerability CVE-2019-1559, see [PAN-SA-2019-0039](https://securityadvisories.paloaltonetworks.com/Home/Detail/202) for details. ## PAN-114403 Fixed an issue on Panorama™ M-Series and virtual appliances where serial numbers for deployed firewalls did not display in the web interface with the exception of GlobalProtect™ cloud service firewalls. ## PAN-114181 Fixed an issue where the firewall incorrectly triggered Reverse Path Forwarding (RPF), which caused packet leaks. ## PAN-113692 Fixed an intermittent issue on a firewall in a high availability (HA) active/passive configuration where five minutes after a failover test IP routes disappeared, which caused traffic interruptions. ## PAN-113446 Fixed an issue where the firewall unintentionally generated the following system log: `Installed content package WildFire is newer than available package, skipping,` when you checked for WildFire updates. ## PAN-112815 Fixed an issue on a firewall in an HA active/passive configuration where a process (useridd) did not respond to the alternate user attribute (**Device** > **User Identification** > **Group Mapping Settings** > **** > **User and Group Attributes**) on the passive firewall during a restart. ## PAN-112814 Fixed an issue where H.323-based calls lost audio because the predicted H.245 session was not converted to Active status, which caused the firewall to drop the H.245 traffic. ## PAN-112729 Fixed an issue on Panorama M-Series and virtual appliances where Decrypted Sessions Info (**Panorama** > **Managed Devices** > **Health** > **All Devices** > **** > **Sessions**) did not display as expected for VM-Series firewalls. ## PAN-112445 Fixed an issue on a firewall in an HA active/passive configuration where a race condition caused the firewall to stop responding after an HA1 link flap. ## PAN-112194 Fixed an issue where packet buffers did not release GlobalProtect clientless VPN packets, which caused the firewall to stop responding. ## PAN-112187 Fixed an issue where a process (report_gen) ran out-of-memory, which caused the dataplane to restart. ## PAN-111897 Fixed an issue where the tags were not set on OSPFv3 routes redistributed to BGP-3. ## PAN-111844 ```caveat VM-50 and VM-50 Lite firewalls only ``` Fixed a rare out-of-memory (OOM) condition. ## PAN-111822 ```caveat PA-3200, PA-5200, and PA-7000 Series firewalls only ``` Fixed an intermittent issue on a firewall configured with policy-based forwarding (PBF) and symmetric return, where traffic dropped because the ARP table did not get updated. ## PAN-111679 Fixed an issue where URL filtering profiles were being incorrectly applied to security policies during a commit. ## PAN-111653 Fixed an issue on PA-7000 Series firewalls where an internal packet buffer leak caused heartbeat failures. ## PAN-111052 Fixed an issue where a firewall silently dropped TCP packets when you enabled the Antivirus profile while the software deterministic finite automation (DFA) option is disabled (DFA is disabled by default). ## PAN-111048 Fixed an issue where the `show object dynamic address group` XML API command returned an invalid error message: `You must specify a valid Device Group`. ## PAN-110996 Fixed an issue where the dataplane stopped responding due to an incorrectly calculated offset when you configured **Exclude video traffic from the tunnel** (**Network** > **GlobalProtect** > **Gateways** > **** > **Agent** > **Video Traffic**). ## PAN-110873 Fixed an issue where member interfaces of the aggregate interface did not display on web interface (**Panorama** > **Managed Devices** > **Health** > **All Devices** > **** > **Interfaces**). ## PAN-110796 Fixed an issue on PA-3200 and PA-5200 Series firewalls where an erroneous dataplane error (`power status is bad, shutting system down`) caused the firewall to shutdown. ## PAN-110758 Fixed an issue on Panorama M-Series and virtual appliances where you were unable to configure the firewall to disable the portal log-in page. ## PAN-110628 Fixed an issue where user groups were deleted from the Group Include List (**Device** > **User identification** > **Group Mapping Settings** > **** > **Group Include List**) if you changed the LDAP server profile account password. ## PAN-110441 ```caveat PA-5200 Series firewall only ``` Fixed an intermittent issue where the internal path monitoring failed, which caused the firewall to unexpectedly restart. ## PAN-110390 Fixed an issue on PA-7000 Series firewalls where invalid filters caused the device management server to stop responding when you generated a database (DB) report from a remote firewall. ## PAN-110336 ```caveat PA-3000, PA-3200, PA-5000, PA-5200, and PA-7000 Series firewalls only ``` Fixed an issue where a process (mpreplay) restarted and caused the offload traffic to drop. ## PAN-110273 Fixed an issue where you were unable to establish OSPF neighborship when an OSPF routing protocol was configured with MD5 authentication and one of the firewalls was restarted. ## PAN-109966 Fixed an issue where the content update threshold downloaded and installed an older content version after you manually installed a newer content version. ## PAN-109954 Fixed an issue where a commit failed with an error message: `cluster is missing 'encryption'` when HA Traffic Encryption (**Panorama** > **Managed WildFire Clusters** > **** > **Communication**) was not configured and after upgrading from PAN-OS 8.0.12 to PAN-OS 8.1.4. ## PAN-109944 Fixed an intermittent issue where a process (configd) restarted due to a race condition when generating custom reports. ## PAN-109837 Fixed an issue where a race condition occurred when a configuration push and Netflow update occurred simultaneously, which caused the dataplane to restart. ## PAN-109803 Fixed an issue where credential phishing prevention did not detect user or password phishing when passwords, which contained two discontiguous character spaces were used. ## PAN-109759 Fixed an issue where the firewall did not generate a notification for the GlobalProtect client when the firewall denied unencrypted TLS sessions due to an authentication policy match. ## PAN-109757 Fixed an issue on Panorama M-Series and virtual appliances where the management server stopped responding when the log collector disconnected and reconnected to Panorama. ## PAN-109665 Fixed an issue where you were unable to disable the Graceful Restart (**Network** > **Virtual Routers** > **** > **BGP** > **Advanced**) configuration. ## PAN-109619 Fixed an issue where a physical or Aggregate Ethernet (AE) Layer 3 configuration edit (**Network** > **Interfaces** > ****) removed the DHCP Client setting when it was configured in the subinterface. ## PAN-109575 Fixed an issue where you were unable to configure more than one device certificate (**Device** > **Certificate Management** > **Certificates** > ****) with **Trusted Root CA**. ## PAN-109344 Fixed an issue where service objects did not import into Panorama when you configured them identically but with different names. ## PAN-109101 Fixed an issue where you were unable to override IKE Gateway configurations (**Network** > **IKE Gateways** > ****) in the template stack. However, with this fix, you still cannot override template stacks when you configure any value with "none." Additionally, to override the Local Identification, select **Authentication** in the pop-up dialogue. ## PAN-108878 Fixed an issue where host traffic ICMP packets larger than 9,180 bytes dropped when you configured a jumbo frame with a maximum MTU value of 9,216 bytes and with the DF option enabled. ## PAN-108846 Fixed an issue where a higher than expected rate of tunnel resolution packets occurred due to an internal loop, which caused a spike in dataplane CPU usage for firewalls that support distributed tunnel ownership. ## PAN-108715 Fixed an issue where the firewall did not update the dataplane DNS cache after the management plane (MP) DNS entries expired, which caused evasion signatures to erroneously trigger a `Suspicious TLS/HTTP Evasion Found` event. ## PAN-108620 Fixed an issue where Traps ESM (**Monitor** > **Traps ESM**) logs were sent to the Log Collector but did not display in the web interface. ## PAN-108459 Fixed an issue where Network Activity (**ACC** > **Network Activity**) incorrectly displayed no session activity at random time points. ## PAN-108409 Fixed an issue on a firewall in an HA active/passive configuration where scheduled dynamic updates pushed from Panorama to the managed firewalls failed. ## PAN-108215 Fixed an issue where the `test security-policy-match` CLI command ignored `source-user` when matching security policies. ## PAN-108164 Fixed an issue where a process (tund) caused the dataplane to restart during a commit. ## PAN-107998 Fixed an issue where you could not log-in to GlobalProtect and resulted in the following error message: `The client certificate is invalid. Please contact your IT administrator`. ## PAN-107662 Fixed an issue on a firewall in an HA active/active configuration where client-bound DHCPv6 packets dropped when you configured the firewall as a DHCPv6 relay agent. ## PAN-107370 Fixed an issue where IPv6 traffic throughput reduced more than expected after you updated a static ND entry (**Network** > **Interfaces** > **** > **Advanced** > **ND Entries**) by moving the interface to a different virtual router. ## PAN-107126 Fixed an issue where an SSL inbound session cache corruption caused a process (all_pktproc) to stop responding. ## PAN-106950 Fixed an intermittent issue where authd CPU usage is higher than expected during RADIUS authentication. ## PAN-106861 Fixed an issue where stale route entries remained in the FIB after the routes were removed from the routing table when you used a redistribution rule without a profile. ## PAN-106783 Fixed an issue where after a SAML authentication an incorrect query was sent to the web browser. ## PAN-106746 Fixed an issue where VoIP traffic dropped when policy-based forwarding (PBF) was configured as a rule. ## PAN-106735 Fixed an issue where the firewall incorrectly set the FPGA, which caused the dataplane to stop responding. ## PAN-106695 Fixed an issue on a firewall in an HA active/passive configuration where the Panorama management server enabled the administrator to clone a rule on the passive firewall. ## PAN-106433 Fixed an issue where after you configured Packet Buffer Protection on a firewall, a process (all_pktproc) stopped responding. ## PAN-106259 Fixed an issue on a firewall in an HA active/passive configuration where the passive firewall reported a higher number of GlobalProtect user accounts than the active firewall. ## PAN-106249 ```caveat PA-200, PA-220, and PA-800 Series firewalls only ``` Fixed an issue where the **Block IP List** option, which is not supported, displayed in the administrator role profile (**Device** > **Admin Role** > **Web UI**). ## PAN-106069 Fixed an issue on a firewall in an HA active/active configuration where the iBGP peer default route did not get added to the routing table after a reboot of either firewall. ## PAN-105925 Fixed an issue where the GlobalProtect Gateway web interface did not display the list of previous users. ## PAN-105466 Fixed an issue where the **Allow matching usernames without domain** (**Device** > **User Identification** > **User-ID Agent Setup** > **Cache**) configuration did not respond without a domain when you used the PAN-OS XML API. ## PAN-105397 Fixed an issue where a firewall incorrectly processed path monitoring, which originated from a NAT firewall on the same network segment. ## PAN-105252 Fixed an intermittent issue on a firewall where dataplane CPU spikes occurred, which caused an LACP flap. ## PAN-105086 Fixed an issue where the firewall incorrectly calculated the password expiry time for admin accounts, which caused Panorama to push locked user accounts. ## PAN-104578 ```caveat PA-800 Series firewalls only ``` Fixed an issue on a firewall in an HA active/passive configuration where the HA failover took longer than expected. ## PAN-104568 Fixed an issue where the firewall did not send emails when you configured the email gateway with an FQDN. ## PAN-104274 Addressed an issue where in a slow network environment the firewall displayed an error message: `error on line 1 at column 1: document is empty` when you used an API call to fetch a license even when the auth code was successfully applied. Extremely slow networks may still see this issue. ## PAN-104264 Fixed an issue where the Panorama management server stopped responding when you upgraded from PAN-OS 8.0.9 to PAN-OS 8.1.3. ## PAN-104007 Fixed an issue where the WildFire signatures sent Windows Server Updates Services (WSUS) traffic when the virus identification was incorrectly enabled in the ms-sms app definition. ## PAN-103863 Fixed an issue where the IPSec tunnel restart (**Network** > **IPSec Tunnels** > **IKE Info**) did not display properly on the web interface. ## PAN-103844 Fixed an issue where Global Find incorrectly returned the query when there were more than one users or groups listed in the security rule. ## PAN-103367 Fixed an issue where Detailed Log View (**Monitor** > **Traffic** > **Detailed Log View**) did not display the file blocking logs as expected. ## PAN-103061 Fixed an issue where special characters contained in the comment field of the Ethernet Interface web interface caused a process (devsrvr) to stop responding. ## PAN-102979 Fixed an issue where Dynamic Updates did not display expired threat prevention licenses when you tried to install an application from Panorama. ## PAN-102595 Fixed an intermittent issue on a firewall in an HA active/active configuration where fragmented ICMP and UDP packets dropped from the packet transmission. ## PAN-102532 Fixed an issue where the firewall used an expired certificate, which caused connecting to Cortex Data Lake to fail. ## PAN-102327 Fixed an issue on PA-3200 Series firewalls in an HA active/passive configuration where the copper ports of passive firewall were active when the passive link state was set to **shutdown**. ## PAN-102145 Fixed an issue where the API keys did not update after you changed the master key. ## PAN-102029 Fixed an issue on a firewall where the DNS resolution routed through the dataplane and configured with a service route, stopped responding when the management interface was not configured. ## PAN-101764 Fixed an issue where a process (slmgr) stopped responding during an auto-commit. ## PAN-101391 Fixed an issue where the scheduled nightly custom report was not generated or emailed as expected. ## PAN-101379 Fixed an issue where an invalid Captive Portal authentication policy was successfully pushed to managed firewalls, which caused autocommits to fail. ## PAN-100832 Fixed an issue where, when you performed a Commit from Panorama to bring a firewall back to sync, the rule order displayed a random distribution instead of reflecting the order configured in Panorama. ## PAN-100742 Fixed an issue on Panorama M-Series and virtual appliances where scheduled reports generated more than one DNS lookups, which caused inconsistent name resolutions for DNS deployments. ## PAN-100693 Fixed an issue where you were unable to process Address Group match criteria when the match name included the double quotation ( " ) character. ## PAN-99976 Fixed an issue where a process (pan_threatvault_reports) caused the elastic search script and another process (configd) to stop responding. ## PAN-99707 Fixed an issue where the command-line interface (CLI) displayed an error message when you used a parenthesis character in a Global Protect External Gateway name. ## PAN-99640 A security-related fix was made to address a denial of service (DoS) vulnerability in PAN-OS Linux Kernel (CVE-2017-8890). ## PAN-99478 Fixed an issue where a daemon (authd) took longer than expected to fetch group mapping, which caused commits to take longer than expected. ## PAN-99354 Fixed an issue where the firewall incorrectly denied URL access when the URL filtering profile was configured to alert. ## PAN-98746 Fixed an issue where GlobalProtect clientless VPN did not get redirected to the application URL when you used Internet Explorer as a web browser. ## PAN-98386 Fixed an issue where a security rule with an "Any" destination address did not shadow rules with IPv6 destination addresses when you performed a commit or configuration validation. ## PAN-98107 Fixed an issue on PA-7000 Series firewalls where Encapsulating Security Payload (ESP) sequence numbers were reused when multiple proxy IDs were in use, which caused ESP traffic to drop while you conducted an ESP sequence check. ## PAN-97953 Fixed an issue where Threats (**Monitor** > **Reports** > **Threat Reports** > **Threats**) did not display resolved Threat IDs to Threat/Content Names for disabled signatures as expected. ## PAN-97862 Fixed an issue where an administrator with a custom configuration role could not export custom reports and returned the following error message: `Error enqueuing export job`. ## PAN-97700 Fixed an issue where administrators could not view Managed Collectors (**Panorama** > **Managed Collectors**) web interface. ## PAN-97488 Fixed an issue on Panorama M-Series and virtual appliances where the commit preview did not display as expected. ## PAN-97288 Fixed an issue on GlobalProtect Clientless VPN where the URL gets truncated when you exclude the domain from the `rewrite exclude domain` list. ## PAN-97187 Fixed an issue on VM-Series firewalls where a configuration commit failed due to a reversed bootstrapping process where the configuration was applied before the auth code. ## PAN-96036 Fixed an issue on Panorama M-Series and virtual appliances where the Group Include List (**Device** > **User Identification** > **** > **Group Include List**) search function did not respond as expected. ## PAN-95644 Fixed an issue on a firewall where the web interface did not display traffic and unified logs due to a race condition. ## PAN-94475 ```caveat Panorama virtual appliances only ``` Improved a condition where a disk calculation error resulted in an erroneous opt/panlogs/ partition full condition and caused a process (CDB) to stop responding. ## PAN-94161 Fixed an issue where the log collector mode did not display logs as expected after you rebooted Panorama. ## PAN-92872 Fixed an intermittent issue where the firewall sent packets incorrectly to an outgoing interface. ## PAN-92161 Fixed an issue where an internal power status reported as `abnormal` caused the firewall to shutdown. ## PAN-92155 Fixed an issue where administrators were unable to configure an IP address using templates for HA2 (**Device** > **High Availability** > **Data Link (HA2)**) after setting the configuration to **IP** or **Ethernet** for Panorama management servers in an HA configuration. ## PAN-81778 Fixed an issue where scheduled reports did not generate as expected due to a race condition. ## PAN-79640 Fixed an issue where the firewall intermittently logged incorrect actions for WildFire submissions and reports.