17 KiB
type, product, version
| type | product | version |
|---|---|---|
| Addressed | PAN-OS | 9.0.9 |
WF500-5320
Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.
PAN-148988
A fix was made to address a Security Assertion Markup Language (SAML) authentication issue (CVE-2020-2021).
PAN-148068
Fixed an issue where SSL connections were blocked if you enabled decryption with the option to block sessions that have expired certificates. This issue included servers that sent an expired AddTrust certificate authority (CA) in the certificate chain.
PAN-145195
and PAN-145149
A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface (CVE-2020-2040).
PAN-145151
and PAN-145149
A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface (CVE-2020-2040).
PAN-145150
and PAN-145149
A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface (CVE-2020-2040).
PAN-145026
Fixed an issue where Cortex Data Lake certificates on the firewall were not automatically renewed after the certificates expired.
PAN-144882
Fixed an issue where the firewall generated critical system logs: Fsck failed for Logging Raid Disk Pair after downgrading from PAN-OS 9.0 to PAN-OS 8.1.
PAN-144782
Fixed an issue where a configuration audit created a large number of opresult.out files, which filled up the session/pan/user_tmp directory in opt/pancfg. This caused a slow Panorama response until a device restart was performed or the files were manually deleted from the root of the device.
PAN-144646
Fixed an issue where a process (varrcvr) stopped responding on the PA-7000 Series Log Forwarding Card (LFC) when it received a verdict from the WildFire cloud.
PAN-143957
Fixed an issue where, after loading a saved configuration snapshot by API, a custom role-based administrator required Superuser privileges to perform a full commit.
PAN-143648
VM-Series firewalls in Azure environment only
Fixed an issue where a kernel panic in a Linux Integration Services (LIS) driver caused the firewall to reboot by itself.
PAN-141563
Fixed an issue where Slot 8 path monitoring failure occurred due to a memory buildup in a process (logrcvr) that was caused by slow communication and connection between log forwarding and Cortex Data Lake.
PAN-140846
Fixed an issue where the dataplane restarted during a commit when Netflow was enabled.
PAN-140494
Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter, pkt_recv_bad_group, is incremented.
PAN-140465
VM-Series firewalls only
Fixed connection issues between IPv6 peers when the IPv6 neighbor cache was synchronized in an HA cluster where, after failover, the newly active firewall did not send multicast neighbor solicitation from its global unicast address.
PAN-140386
Fixed an intermittent issue where the firewall used IP addresses instead of domain names for URL category lookup after upgrading to 9.0.6.
PAN-139935
Fixed an issue in the URL process where a process (devsrvr) stopped responding.
PAN-139764
Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.
PAN-139718
Fixed an issue where the firewall failed stateful inspection for GTP forward relocation requests greater than 1,500 bytes and could not parse Access Point Name (APN) information in forward relocation requests.
PAN-139587
PA-5200 Series and PA-7000 Series firewalls only
Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.
PAN-139391
Fixed an issue where unique GlobalProtect portal profiles were not selected in the correct order.
PAN-138870
Fixed an issue where a process (configd) restarted and administrators received one of the following error messages: Timed out while getting config lock. Please try again or Please wait while the server reboots... due to a database error.
PAN-138813
Fixed a performance drop issue seen when using API to configure larger sets of objects (more than 25 objects).
PAN-138739
Fixed an issue where, in a high availability (HA) active/active configuration in a virtual wire deployment with asymmetric traffic, decryption did not work for some sites.
PAN-138476
Fixed an intermittent issue where logs were delayed or missing when querying for logs by applying filters. To leverage this fix, you must upgrade Panorama to 9.0.9 and the Cloud Services plugin to 1.6.0-h1.
PAN-137966
Fixed a configuration lock issue where Panorama timed out due to a process (configd) being unable to read another process (mongod).
PAN-137902
PA-7000 Series firewalls only
Fixed an issue where hot swapping a PA-7000 100G NPC with a PA-7000 20G NPC caused packet buffer leak and slot restarts.
PAN-137867
PA-7000 Series firewalls only, running with both a PA-7000 100G NPC and a PA-7000 20G NPC
Fixed an issue where IPSec traffic caused dataplane restarts.
PAN-137387
Fixed an issue where URL filtering used the IP address instead of the hostname, which led to incorrect URL categorization.
PAN-137138
Fixed an issue where a process (configd) consistently restarted with the following error message: virtual memory limit exceeded, restarting due to a dynamic updates push from Panorama to multiple firewalls.
PAN-136703
PA-3000 Series and PA-800 Series firewalls only
Fixed an issue with insufficient memory allocation for configurations to accommodate the PAN-OS 9.0 Dynamic Address Group feature.
PAN-136649
Fixed an issue where PA-7000 20GXM and PA-7000 20GQXM Network Processing Cards (NPCs) failed to process some sessions for Layer 7 inspection due to internal maximum threshold value that was not set.
PAN-136608
Fixed an issue in Panorama where the Security policy Target displayed the serial number of the targeted device instead of the hostname.
PAN-136390
PA-7000 Series with 100GB NPC only
Fixed an issue during firewall bootup where the following error message: Bootloader upgrade failed, ret 255 appeared when small form-factor pluggable (SFP) modules were installed.
PAN-135865
Fixed an issue that prevented Panorama from being switched out of management-only mode when deployed in Amazon Web Services (AWS) instance types M5 and C5.
PAN-135684
Fixed an issue with log collectors on Panorama where large index sizes caused higher CPU usage than expected when disk space usage was high.
PAN-135587
Fixed an issue where the GlobalProtect gateway was unable to parse a large list of IP addresses assigned on a local machine.
PAN-135039
Fixed an issue in Panorama where a memory leak occurred during an HA sync commit.
PAN-134309
Fixed an issue where a process (devsrvr) restarted when it hit the limit of the number of custom patterns available in the allocated memory.
PAN-133731
Fixed an issue on the Panorama Virtual Appliance where the show interface all CLI command did not list any output.
PAN-133727
Fixed an issue where Session Initiation Protocol (SIP) messages were not parsed correctly when the packet was received in separate segments, which caused the receiver to receive corrupted messages.
PAN-133614
Fixed an issue on the Panorama Virtual Appliance where SNMP Object IDs (OIDs) were missing for interfaces other than the Management interface.
PAN-133495
Fixed an issue where the Terminal Server (TS) Agent disconnected on the firewall after a failover or reboot.
PAN-133411
Fixed an issue where after making configuration changes and selecting Preview Changes, a 500 Internal Server Error message displayed due to a memory leak.
PAN-133211
Fixed an issue where the policy order was not maintained when moved to a different device group.
PAN-132995
PA-7000 Series and PA-3200 Series firewalls only
Fixed an issue where when jumbo frames were enabled, the maximum transmission unit (MTU) size limit was lower than expected.
PAN-132766
Fixed an issue in Panorama where custom region objects were not visible in the GlobalProtect Portal External Gateway drop-down.
PAN-132712
Fixed an issue where scheduled reports did not run on a PA-7000 Series firewall not managed by Panorama after upgrade to 8.1.10 or 9.0.4 and later versions.
PAN-132476
Made improvements to the log storage for VM-Series for NSX Panorama.
PAN-131945
Fixed an issue where Device > VM-Series on the firewall web interface showed a blank screen.
PAN-131792
Fixed an issue where the Name log filter (Monitor > Logs > Traffic) was not maintained when viewing the Log Viewer for a Security policy rule (Policies > Security) from the drop-down.
PAN-131501
Fixed an issue when configuring Clientless VPN and executing the portal-getconfig CLI command where user groups were retrieved but were not freed, which caused a memory leak on a process (sslvpn).
PAN-131290
Fixed an issue where reports from Panorama displayed the following messages: Please wait... and Warning: Some of the devices are in High Speed Log Forwarding Mode.
PAN-131038
Fixed an issue on the firewalls where the FIB lookup routing test did not display all available paths on the web interface.
PAN-130870
Fixed an issue where the management plane CPU on the firewall was high due to index generation on summary logs.
PAN-130776
Fixed an issue on Panorama where Applications and Threats content update deployment failed due to the content version date check.
PAN-130558
Fixed an issue on the firewalls where SNMP queries for panZoneTable listed details for only one zone when there were two zones with same names under different virtual systems.
PAN-130121
Fixed an issue in Amazon Web Services (AWS) where Ethernet1/1 failed DHCP renewal after the hour.
PAN-129281
Fixed an issue where a process (useridd) restarted due to a buffer overflow when the time-to-live (TTL) and Idle Timeout values were set to Never, a timing issue between user group context and a process (sysd) callback, and a group mapping issue when multiple group mappings fetched the same groups with different override domains.
PAN-128879
Fixed an issue where the PAN-OS XML API inject was not working for IP address to user mappings or for the import of software, content, and plugins.
PAN-128393
Fixed an issue where User-ID running on port 5007 responded with the default certificate and participated in mutual authentication after upgrading to PAN-OS 9.0, which exposed the default certificate on the firewall to third-party vulnerability scanners.
PAN-128155
Fixed an issue where system log entries misspelled "client version" as "lient version", which made it difficult for syslog servers to find these entries.
PAN-128078
Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled.
PAN-127434
Fixed an issue where reports for URLs were not generating the correct data output.
PAN-127375
Fixed an issue where a process (rasmgr) restarted multiple times, which caused the firewall to reboot.
PAN-127260
Fixed an issue where the /opt/pancfg partition became full due to a large amount of botnet reports that were not automatically deleted.
PAN-125524
Fixed an issue where the dataplane restarted when many NAT rules were followed by successive commits.
PAN-125501
Fixed an issue where URL information in a URL Custom Report was blank when the report contained flexible size fields (such as URL Category List).
PAN-125466
Fixed an issue where, during Antivirus or Threat Content update downloads or install, some show commands in the CLI, API calls, and web interface pages gave information output with significant delay (15-60 seconds).
PAN-124916
Added two ciphers for GlobalProtect Portal TLS connections.
PAN-123279
Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.
PAN-123090
PA-3000 Series firewalls only
Fixed an issue where a configuration commit failed due to a memory allocation failure on the dataplane.
PAN-122226
Fixed an issue where traffic failed to match Security policies using wildcard address objects.
PAN-121602
Fixed an issue on Panorama where a query (after-change-preview contains) did not return the expected results for configuration logs.
PAN-120830
Fixed an issue in Panorama where certificate import failed with the following error message: Certificate chain cannot be validated, required CAs not found.
PAN-120614
Fixed an issue where a commit from a Panorama appliance running PAN-OS 9.1 to a managed firewall running PAN-OS 9.0 or earlier failed with the following error message in ms.log: error generating tranform ike-pre-transform.xsl.
PAN-120454
Fixed an issue where the firewall did not fail over to the secondary LDAP server when the primary LDAP server was not reachable and the configured LDAP bind timeout was not properly honored when SSL protocol was used.
PAN-120113
Fixed an issue where the to, from, and subject fields did not populate in the threat logs if the fields were out of order.
PAN-120105
Fixed an issue where email header information intermittently was not present in threat logs.
PAN-119645
Fixed an issue where a process (panio) used unnecessary memory and caused an out-of-memory (OOM) condition on the dataplane if the dataplane was already low on memory.
PAN-119170
Fixed an issue where Panorama did not display managed devices when selecting Revert Content (Panorama > Device Deployment > Dynamic Updates).
PAN-119159
Fixed an issue where if one invalid FQDN object was configured, FQDN resolution failed for all FQDN objects.
PAN-118098
Fixed an issue where a process (useridd) restarted while updating user groups. This issue occurred when multiple group mapping profiles were used to fetch the same group information while using different domain override settings.
PAN-117606
Fixed an issue where a process (configd) crashed while making configuration changes on Panorama.
PAN-117487
Fixed an issue where a process (mgmtsrvr) stopped responding due to a memory corruption issue when acquiring a configuration lock.
PAN-117075
Fixed an issue where the firewall did not process the TLS record in SSL Inbound Inspection as expected, which introduced out-of-order packets in the transmit stage packet capture and affected client performance while accessing HTTP video applications.
PAN-116835
Fixed an issue with log reading performance when using WMI for server monitoring with PAN-OS integrated User-ID agent.
PAN-116720
A fix was made to address a reflected cross-site scripting (XSS) vulnerability in the PAN-OS management web interface where, if a remote attacker was able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link, the attacker could execute arbitrary code JavaScript code in the administrator's browser and perform administrative actions (CVE-2020-2036).
PAN-115914
Fixed an issue where Static, Connected, and Host routes were missing on the FIB table of the firewall in a passive state after 300 seconds of switch over.
PAN-112120
Fixed an issue where threat Name field of a threat Custom Report displayed the threat ID instead of the threat name.
PAN-111379
Fixed an issue on the firewall where the Application Command Center (ACC) Network Activity tab displayed the message In Progress and stopped responding.
PAN-110457
Fixed an issue where Panorama ran out of memory due to high memory usage on a process (configd).
PAN-106763
Fixed an issue where the dataplane crashed while freeing up memory due to a corrupted or long certificate field in the handshake.
PAN-102202
Fixed an issue where the OSPF summary Link State Advertisement (LSA) for the default 0.0.0.0/0 route were not advertised by the Area Border Router (ABR).
PAN-98933
Fixed an issue on an M-Series appliances in a high availability (HA) active/passive configuration where the schedules (Device > Dynamic Updates) were unresponsive after a failover or restart of Panorama.
PAN-98694
Fixed an issue on a PA-5200 Series firewall in an HA active/passive configuration where the firewall dropped TCP-FIN packets after a failover.