135 lines
6.1 KiB
Markdown
135 lines
6.1 KiB
Markdown
---
|
||
type: Addressed
|
||
product: PAN-OS
|
||
version: 8.1.19
|
||
source: common-crawl
|
||
crawl: CC-MAIN-2026-12
|
||
---
|
||
|
||
## PAN-161731
|
||
|
||
Functionality was added to enable, via the CLI, the removal of key exchange algorithms used by SSH.
|
||
|
||
- Use debug system ssh-kex-prune cipher [diffie-hellman-group1-sha1 diffie-hellman-group-exchange-sha1 .. ] to enable removal of specified key exchanges.
|
||
- Use debug system ssh-kex-prune none to enable addition of key exchanges.
|
||
|
||
## PAN-159135
|
||
|
||
Fixed an issue where the firewall rejected SAML Assertions, which caused user authentication failure when the **Validate Identity Provider Certificate** was enabled in the SAML Server Profile in vsys3 or above.
|
||
|
||
## PAN-158988
|
||
|
||
Fixed an issue with HTTP Header Insertion where the payload was truncated when processing a segmented TCP stream and when the client retransmitted the packet with the same sequence number that was previously received segmented.
|
||
|
||
## PAN-158844
|
||
|
||
Adds additional debugging to be used in identifying the malformed references causing process crashes during FQDN refresh.
|
||
|
||
## PAN-158638
|
||
|
||
Fixed an issue where the firewall returned the following error message when attempting to request a device certificate using a one-time password (OTP): invalid ocsp response sig-alg.
|
||
|
||
## PAN-156240
|
||
|
||
A fix was made to address an issue where a cryptographically weak pseudo-random number (PRNG) was used during authentication to the PAN-OS interface. As a result, attackers with the capability to observe their own authentication secrets over a long duration on the firewall had the ability to impersonate another authenticated web interface administrator’s session ([CVE-2021-3047](https://security.paloaltonetworks.com/CVE-2021-3047)).
|
||
|
||
## PAN-155009
|
||
|
||
Fixed an issue on the firewall where executing the request system bootstrap-usb prepare CLI command returned a server error.
|
||
|
||
## PAN-154114
|
||
|
||
A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where secrets in PAN-OS XML API requests were logged in cleartext in the web server logs when the API was used incorrectly ([CVE-2021-3036](https://security.paloaltonetworks.com/CVE-2021-3036)).
|
||
|
||
## PAN-153213
|
||
|
||
Fixed a rare issue where TCP packets randomly dropped due to reassembly failure.
|
||
|
||
## PAN-152648
|
||
|
||
Fixed an issue where multiple all_pktproc processes stopped responding, which caused the dataplane to restart.
|
||
|
||
## PAN-152098
|
||
|
||
Fixed an issue where the Policy Optimizer for some device groups showed incorrect data with a - character in the rule usage column.
|
||
|
||
## PAN-151458
|
||
|
||
Fixed an issue on firewalls with high availability active/active configurations where GlobalProtect gateways timed out on-demand connections. This occurred because the **Inactivity Logout** timer did not reset.
|
||
|
||
## PAN-150998
|
||
|
||
Fixed an issue where, when deploying a VM-Series firewall on VMware NSX that had been assigned a serial number that was used by a previously deactivated firewall, the new firewall was deployed in a deactivated or partially deactivated state.
|
||
|
||
## PAN-150852
|
||
|
||
Fixed an issue with SMTP that occurred when attachment file names were longer than the allocated buffer. If the file name was longer than the buffer and Layer 7 inspection was enabled, the file was dropped, which caused session errors and an email to not be sent.
|
||
|
||
## PAN-150798
|
||
|
||
```caveat
|
||
PA-7000 Series firewalls only
|
||
```
|
||
|
||
Fixed an issue where Network Processing Cards (NPC) took longer than expected or failed to boot.
|
||
|
||
## PAN-150023
|
||
|
||
A fix was made to address an issue where an improper authentication vulnerability enabled a Security Assertion Markup Language (SAML) authenticated user to impersonate any user in the GlobalProtect portal and GlobalProtect gateway when they were configured to use SAML authentication ([CVE-2021-3046](https://security.paloaltonetworks.com/CVE-2021-3046)).
|
||
|
||
## PAN-149641
|
||
|
||
Fixed an issue where firewalls stopped refreshing IP tag information when configured with the **VM Information Sources** feature with a VMWare vCenter Server.
|
||
|
||
## PAN-149339
|
||
|
||
Fixed an issue where, when an ECMP route changed, the flow table in the offload engine was not updated.
|
||
|
||
## PAN-147783
|
||
|
||
Checks were added to help prevent the dataplane from restarting.
|
||
|
||
## PAN-147781
|
||
|
||
A fix was made to address an issue where an OS command argument injection vulnerability in the PAN-OS web interface enabled an authenticated administrator to read any arbitrary file from the file system ([CVE-2021-3045](https://security.paloaltonetworks.com/CVE-2021-3045)).
|
||
|
||
## PAN-147254
|
||
|
||
jQuery was updated to 3.5.1.
|
||
|
||
## PAN-147221
|
||
|
||
Improved QoS scheduling for Bidirectional Forwarding Detection (BFD) and BGP to address the internal handling of BGP and BFD packets under high resource constraints
|
||
|
||
## PAN-145733
|
||
|
||
Fixed an issue where the SNMP INDEX for panZoneTable on the PAN-COMMON-MIB.my file did not work as expected, which led to entries in panZoneTable not being uniquely identified.
|
||
|
||
## PAN-144975
|
||
|
||
Fixed an intermittent issue where a high traffic load in a Layer 2 deployment caused SNMP and Panorama health monitoring failures.
|
||
|
||
## PAN-136347
|
||
|
||
Fixed an issue wherer DNS proxy TCP connections were processed incorrectly, which caused a process (dnsproxy) to stop responding.
|
||
|
||
## PAN-136073
|
||
|
||
Fixed an issue where the High Speed Chassis Interconnect (HSCI) port flapped continuously after an upgrade or reboot.
|
||
|
||
## PAN-132035
|
||
|
||
Fixed an issue on Panorama appliances in an active/passive HA configuration where a managed firewall generated high priority alerts that it failed to connect to the passive Panorama appliance's User-ID agent server. This issue occurred because the firewall was only able to connect to one Panorama User-ID server at a time, and it connected only to the active Panorama appliance's User-ID server.
|
||
|
||
## PAN-131474
|
||
|
||
A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where the connection details for a scheduled configuration export were logged in system logs ([CVE-2021-3037](https://security.paloaltonetworks.com/CVE-2021-3037)).
|
||
|
||
## PAN-128042
|
||
|
||
Fixed an issue where the dynamic address group failed due to a process (devsrvr) not being synced with another process (useridd).
|
||
|
||
## PAN-124579
|
||
|
||
Fixed an issue where a process (all_task_3) restarted, which caused the tunnels to reset.
|