CVE-2024-3386 - PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended

Back Back to CVE browser

MEDIUM

PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended

Published Apr 10, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.13
- Version
  10.1.0
  Status
  affected
  Constraints
  <10.1.10
- Version
  10.1.0
  Status
  affected
  Constraints
  <10.1.9-h3
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.4-h2
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.5
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.0.1-h2
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.0.2
- Version
  9.0.0
  Status
  affected
  Constraints
  <9.0.17-h2
- Version
  9.1.0
  Status
  affected
  Constraints
  <9.1.17
- Version
  11.1.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
10.0.0	affected	<10.0.13
10.1.0	affected	<10.1.10
10.1.0	affected	<10.1.9-h3
10.2.0	affected	<10.2.4-h2
10.2.0	affected	<10.2.5
11.0.0	affected	<11.0.1-h2
11.0.0	affected	<11.0.2
9.0.0	affected	<9.0.17-h2
9.1.0	affected	<9.1.17
11.1.0	unaffected	-

Remediation

Vendor solution

This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.

Weaknesses (1)

CWE-436