Fixed an issue on WF-500 that caused cloud queries to fail when the cloud verdict did not match the local verdict.

Fixed an issue where the Log Processing Card (LPC) did not come up intermittently in a fully loaded PA-7000 Series.

(

PA-7000b Series firewalls with Log Forwarding Cards (LFC) only

) A security fix was made to restrict improper communications to the LFC (CVE-2019-17440/PAN-SA-2019-0040).

Fixed an issue where a race condition caused

pan_task

and

pan_com

to exit unexpectedly.

Fixed an issue where Internet Protocol (IP) to user mappings were not synced from the HUB virtual system (vsys) to the non-hub vsys.

Fixed an issue where the mprelay process could crash during commit if the devsrvr process was restarted before or during the commit.

Fixed an issue where an XML API call incorrectly masked the response, which prevented role based administrators from running the response.

Fixed an issue where after you switched the

Context

from Panorama™ to a firewall, the DESTINATION ZONE (

Policies > Security > <

policy-name

> > Destination

) incorrectly displayed

none

.

Fixed an issue on Panorama M-Series and virtual appliances where the

<show><object><registered-ip></registered-ip></object></show>

XML API call did not retrieve more than 500 entries.

Fixed an issue where DP crashed during file transfer due to one or more content updates being installed.

Fixed an issue where the management plane CPU on the firewall was high due to index generation on summary logs.

Fixed an issue where required fields were masked incorrectly in a XML API call, which hid the response.

Fixed an issue where a large number (65,000) of GlobalProtect™ user connections caused a process (sslvpn) to stop responding after you upgraded from PAN-OS

®

8.1.10 to PAN-OS 8.1.11.

Fixed an issue where the firewall incorrectly interpreted an external dynamic list MineMeld instability error code as an empty external dynamic list.

Fixed an issue on the firewalls where the dataplane restarted unexpectedly when processing HTTP/2 traffic if packet-diag debugs were enabled.

Fixed an issue where GTP inspection stopped functioning after unrelated changes in policy and a commit followed by a high availability (HA) failover.

Fixed an issue where the concurrent file limitation for WildFire

®

submissions didn't work when the firewall had many files waiting to be uploaded, which caused

/opt/panlogs/wildfire/tmpfile

to become full and destabilize the firewall (for example, the process crashed or system logs were not written).

Fixed a rare timing window that caused an Internal packet path monitoring failure.

Fixed an issue where log export from maintenance mode failed with the following error message:

no ip address configured, can't export logs

even though the management interface Internet Protocol (IP) address was configured.

Fixed an issue where the disk usage calculation was getting corrupted and purging logs.

(

PA-5250, PA-5260, and PA-5280 firewalls with 100GB AOC cables only

) Fixed an issue where after you upgraded the first peer in a high availability (HA) configuration to a PAN-OS 9.0 release, the High Speed Chassis Interconnect (HSCI) port did not come up due to an FEC mismatch until after you finished upgrading the second peer.

A fix was made to address a vulnerability with a race condition due to an insecure creation of a file in a temporary directory in PAN-OS (CVE-2020-2016).

Fixed an issue where a purge script stopped responding, which caused a process (logrcvr) to discard incoming logs.

Fixed an intermittent issue where the default route did not redistribute to an OSPF Not-So-Stubby Area (NSSA).

A security fix was made to address an OpenSSL vulnerability (CVE-2019-1547/CVE-2019-1563).

Fixed an issue where a process (all_pktproc) stopped responding due to a NULL pointer exception while cleaning up SSL proxy sessions previously configured for GlobalProtect.

Fixed an intermittent issue where after you configured

Cache EDNS Responses

(

Network > DNS Proxy > <DNS Proxy-name> > Advanced

) a process (dnsproxy) stopped responding.

Fixed an issue where the firewall did not match the Security policy when you configured the match condition to a shared local group.

Fixed an issue on Panorama M-Series and VM-Series where the configd process would crash.

Fixed an issue where a process (openssl) caused higher than expected management CPU usage due to the incompletion of the Online Certificate Status Protocol (OCSP) during the logging service certificate validation.

Fixed an issue where multiple

No valid URL filtering license

warning messages were generated during a commit due to an expired URL filtering license. With this fix, the warning messages are grouped into a single message per virtual system (vsys).

Fixed an issue where the configd process on a Panorama appliance had a memory leak during commit operations.

Fixed an issue where the real-time clock (RTC) battery voltage exceeded the maximum threshold and triggered alerts in the system log.

Fixed an issue on the firewalls where the rasmgr process restarted unexpectedly when using third-party VPN clients to connect to GlobalProtect.

A fix was made to address a cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS and Panorama that disclosed an authenticated PAN-OS administrator's PAN-OS session cookie (CVE-2020-2013).

Fixed an issue on Panorama M-Series and virtual appliances where after you configure the firewall with an API call commits took longer than expected.

(

PA-7000b Series firewalls only

) Fixed an issue where logs were unexpectedly discarded.

Fixed an issue where a null point (policy) dereference was causing a crash.

Fixed an issue where traffic logs that contained incorrect Security policies were generated during an active commit process when the Security policies were being added or removed.

Fixed an issue on PA-220, PA-820, and PA-850 firewalls where Custom Signatures caused the CTD memory depletion (OOM), which led to a dataplane crash.

Fixed an issue in Panorama where the

Policies > Security

web interface flashes and the selected security rule did not stay selected when making a change to a rule that was part of device group that included more than 200 rules.

A fix was made to address a missing XML validation vulnerability in the PAN-OS web interface (CVE-2020-1975).

Fixed an issue where an out of memory condition caused commits to fail with the following error:

Error unserializing profile objects failed to handle CONFIG_UPDATE_START

.

Fixed an issue where the firewall dropped pre-VLAN spanning tree (PVST+) packets from the virtual wire interface when you executed the

set session rewrite-pvst-pvid yes

CLI command.

Fixed an issue where Address Resolution Protocol (ARP) randomly failed on one of the interfaces for a firewall deployed in the KVM/GCP/ESXi clouds.

Fixed an issue where HTTP/2 traffic inspection caused a software buffer leak over time and affected decryption traffic.

Fixed an issue for Cloud/VM platforms where the tunnels between the log collectors did not come up when a public IP was used for the log collectors in an environment with a Panorama management server and two or more log collectors.

Fixed an issue where App-ID™ signatures failed to match when there were more than 12 partial App-ID matches within the same session.

Fixed an issue where the snmpd process was crashing when polling for global counters.

A fix was made to address an authentication bypass vulnerability in the Panorama context switching feature (CVE-2020-2018).

(

PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls running PAN-OS 9.0.5 only

) Fixed an intermittent issue where a process (all_pktproc) stopped responding due to a Work Query Entry (WQE) corruption that was caused by duplicate child sessions.

Fixed an issue where the

Dashboard

did not display the release dates for Application Version, Threat Version, and Antivirus Version.

Fixed an issue where a process (mprelay) stopped responding.

Fixed an issue where the firewall incorrectly logged target filenames when an antivirus signature was triggered over a Server Message Block (SMB) protocol.

Fixed an issue where the firewall did not respond to TCP DNS requests when the firewall acted as a DNS proxy.

Fixed an issue where the routing daemon restarted due to a deadlock on the path monitoring heartbeat processing, leading to a SIGABRT.

Fixed an issue where a log collector with a dynamically assigned IP address could not establish communication between other log collectors.

Fixed an issue where the DHCP server incorrectly processed bootp unicast flag requests.

Fixed an issue where parent sessions were dropped when you installed duplicate predict session.

(

PA-3200 Series and PA-5200 Series firewalls only

) Fixed an issue where the firewall did not capture inbound Encapsulating Security Payload (ESP) protocol 50 packets at the receive stage.

(

PA-800 Series and PA-220 firewalls only

) Fixed an issue where the hrProcessorLoad.2 OID displayed incorrect values.

Fixed an issue where allow lists and auth profiles in multi-vsys systems would not allow a user to be identified in user groups.Users would show as

Not in allow list

because the multi-vsys (vsys1) was shown as

vsys0

.

(

PA-7000 Series firewalls using PA-7000-20G-NPC cards only

) Fixed an issue where the firewall restarted due to an internal path monitoring heartbeat failure during periods of more than expected traffic load.

(

PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls only

) Fixed an issue where the dataplane sent positive acknowledgments to predict-status checks from FPP when the corresponding predict was deleted, which caused SIP and RTSP applications to perform less than the expected achievable performance.

Fixed an issue where downloading the GlobalProtect app software on your GlobalProtect portal took longer than expected.

Fixed an intermittent issue where the dataplane stopped responding when processing compressed traffic.

Fixed an issue where Internet Protocol (IP) tags with timeouts generated alert messages.

Fixed an issue where the varrcvr process crashed due to memory corruption issues.

A fix was made to address a DOM-based cross site scripting vulnerability in the PAN-OS and Panorama management web interfaces (CVE-2020-2017).

Fixed an issue involving unexpected behavior within the GlobalProtect app where the Active viewed Template does not populate when clicking the hyperlink to trigger a redirect to the Template area and list.

Fixed an issue where a process (routed) stopped responding when you configured virtual interfaces.

Fixed an issue where certificate revocation list (CRL) and Online Certificate Status Protocol (OCSP) checks did not respond as expected when you configured

Block session if certificate status is unknown

.

Fixed an issue to improve the validation of certain field inputs in the web interface.

Fixed an issue on a firewall in a high availability (HA) active/passive configuration where after you submitted a host information profile (HIP) report a duplicate User-ID™ log was generated on the passive firewall.

Fixed an issue where the Security Parameter Index (SPI) size was incorrectly set in the IKE Phase 2 packet when you configured

commit-bit

on the neighboring device, which caused IKE negotiations to fail on the neighboring device.

Fixed an issue where pushing a config bundle from Panorama M-Series to a firewall failed with the following error:

log-card -> iptag unexpected here

.

Fixed an issue where URL filtering blocked web traffic by the security policy that did not have URL filtering enabled.

(PA-800 Series) Fixed an issue where the deployment of the Master Key through the web interface failed.

Fixed an issue on VM-Series firewalls where the ager ran faster than expected, which prematurely caused the master key to expire.

Fixed an issue in Panorama where you could not see

Certificate Profile

in the drop-down when adding an HTTP Server Profile.

A fix was made to address an external control of path and data vulnerability in the Palo Alto Networks Panorama XSLT processing logic (CVE-2020-2001).

Fixed an issue where the firewall caused unnecessary fragmentation when traffic and tunnel were content inspected, which caused retransmission and slowed response time.

Fixed an issue where you were unable to view DHCP leases from the web interface or through the

show dhcp server lease interface all

CLI command due to the request taking longer than expected, which resulted in a time out.

Fixed an issue where temporary files created on a firewall during an API call execution were not properly cleaned up, leading to increased disk space usage.

Fixed an issue where Panorama did not send correlation events and logs to the syslog server after you upgraded the firewall from PAN-OS 8.0.9 to PAN-OS 8.1.7.

Fixed an issue where the firewall incorrectly forwarded incomplete and corrupted files through the Server Message Block (SMB) protocol to WildFire. This fix requires content release version 8219 or a later version.

Fixed an issue on a firewall in a high availability (HA) active/passive configuration where a process (flow_ctrl) received and restarted due to a malformed ICMPv6 neighbor advertisement packet.

Fixed an issue in Panorama where the

show config diff

command was not working correctly and produced unexpected output.

Fixed an issue where you were not redirected to the application URL after authentication.

Fixed an issue where the firewall incorrectly calculated the TCP segment size when performing forward proxy decryption.

Fixed an issue where

Discover

(

Device > User Identification > User Mapping > Server Monitoring

) stopped responding after you configured a DNS proxy.

Fixed an issue where corrupt logs caused buffered log forwarding to stop responding.

Fixed an issue where the firewall web interface did not display the BGP

MED

attribute value in the BGP

Rib-Out

tab (

Virtual Routers > More Runtime Stats

).

Fixed an issue on Panorama M-Series and virtual appliances where communication between two processes (mgmtsrvr and logd) stopped responding.

Fixed an issue where updates (including WildFire, antivirus, and so on) were intermittently failing.

An enhancement was made to improve subsequent loading times of device groups after the first load.

Fixed an issue on Panorama M-Series and virtual appliances where custom reports from the User-ID log displayed the incorrect receive date.

Fixed an issue where a daemon (dnsproxy) incorrectly handled TCP requests, which caused the daemon (dnsproxy) to stop responding.

Fixed an issue where local user group names that contained upper case characters were not converted to lower case characters prior to encoding, which caused the firewall not to load user groups names with upper case characters.

Fixed an issue where moving multiple rules in Panorama using the

Move All rules in Group

and

Move rules in group to different rule base

group actions caused the rules to move in a reversed order.

Fixed an issue in Panorama where on a high availability (HA) pair working in legacy mode, the following error message displayed in the system log:

Panorama has lost connection to its peer, no log will be forwarded

.

A fix was made to address an authentication bypass spoofing vulnerability in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS (CVE-2020-2002).

Fixed an issue where the BGP Conditional Advertisement suppress condition was not met, which caused the

Conditional Adv

(

Network > Virtual Routers > <router-name> > BGP

) not to apply the NEXT HOPS prefix range.

Fixed an issue on a firewall in a high availability (HA) active/active configuration where larger than expected packets sizes were silently dropped when traversing through an HA3 link in an asymmetric network.

(

PA-5200 Series firewalls only

) Fixed an issue where applications using the GlobalProtect Clientless VPN did not respond when the Clientless VPN used a VLAN interface.

(

PA-5200 Series firewalls only

) Fixed an issue where the

show system logd-quota

CLI command did not display the Session log storage Quotas as expected.

Fixed an issue where you were unable to generate WildFire analysis reports in the WildFire Submissions log when you configured

Proxy Server

(

Device > Setup > Services > Global

).

Fixed an issue where traffic logs and URL Filtering logs did not display the URL for decrypted traffic.

Fixed an issue where the Security Assertion Markup Language (SAML) for GlobalProtect did not respond as expected when you configured the IdP certificate as

None

on the SAML IdP server profile.

Fixed an issue where an API call against a Panorama management server, which triggered the

request analyze-shared-policy

command, caused Panorama to reboot after you executed the command.

Fixed an issue where application dependency warnings were displayed after a commit when the policy rules containing the dependent applications used different sources (one used user and the other used groups).

Fixed an issue on Panorama M-Series and virtual appliances where

User Activity Report

(

Monitor > PDF Reports

) did not generate reports as expected.

Fixed an issue where the BGP conditional advertisement did not respond as expected, which caused the prefix in the

Advertise Filters

(

Network > Virtual Router > BGP > Conditional Adv

) to be incorrectly advertised.

Fixed an issue where some packets had incorrect timestamps in the transmit stage during packet capture.

Fixed an issue where the firewall did not exclude video traffic from the GlobalProtect tunnel when you configured

Exclude video traffic from the tunnel (Windows and macOS only)

(

Network > GlobalProtect > Gateways > <gateway-name> > Agent > Video Traffic

).

An enhancement was made to enable administrators to select signature and digest algorithms for outgoing Security Assertion Markup Language (SAML) messages through a CLI command.

Fixed an Issue where the dataplane stopped responding due to an incorrect parsing of cookies for GlobalProtect Clientless VPN applications.

Fixed an issue on a firewall in a high availability (HA) active/active configuration where virtual MAC addresses pushed from Panorama were overridden on the local firewall.

Fixed an issue in Panorama where

Packet Capture

was enabled with

extended-capture

(

Objects > Security Profiles > Anti-Spyware

) for DNS signatures, but the setting was not pushed to firewalls running PAN-OS 8.1.

A fix was made to address a vulnerability with the Nginx web server included with PAN-OS (CVE-2017-7529).

Fixed an issue where the firewall did not release the default DHCP route when a new IP address was obtained on a DHCP configured interface.

Fixed an issue where GlobalProtect authentication failed when you used the domain in the group mapping and a User Principle Name (UPN) format for authentication.

Fixed an issue on a firewall in a high availability (HA) active/active configuration where the names of the virtual routers were pushed from the active-primary firewall to the active-secondary firewall when you sync the configuration, which caused schema verification to stop responding when you do a local commit on the active-secondary firewall.

Fixed an issue where vsysadmins were unable to view the locks on all the virtual systems they were assigned to. To view the locks in CLI run the new

show commit-locks vsys

and

show config-locks vsys

CLI commands.

Fixed an issue where a process (configd) exceeded the memory limit and stopped responding.

Fixed an issue where you were unable to establish an SSH session through a CLI command using a Diffie-Hellman (DH) algorithm.

Fixed an issue where commits failed when address objects were used in static route configurations.

Fixed an issue where authentication failed for newly added groups in the authentication profile Allow List.

Fixed an issue with Panorama on AWS where the configuration of the high availability (HA) pair became out of sync due to different plugin versions being detected even though the same versions were installed on both peers.

(

PA-5200 Series firewalls only

) Fixed an issue on a firewall in a high availability (HA) active/passive configuration where an HA1 heartbeat backup connection flap occurred and displayed the following error message:

ha_ping_send/No buffer space available

.

Fixed an intermittent issue on a firewall in a high availability (HA) active/passive configuration where traffic interruptions occurred until you triggered a manual failover.

Fixed an issue where a process (mprelay) stopped responding and invoked an out-of-memory (OOM) killer condition and displayed the following error messages:

tcam full

and

pan_plfm_fe_cp_arp_delete

.

Fixed an issue where a PA-7080b HA pair rebooted when large sized packet traffic impacted the front panel ports of the Log Forwarding Card (LFC).

Fixed an issue where SSL renegotiation sessions incorrectly identified URL categories.

Fixed an issue where the firewall was unable to access the CPU information and caused the CPU frequency to set to 0, which resulted in a divide by zero error and caused a process (devsrvr) to stop responding.

Fixed an issue where trunk interfaces were not working on Hyper-V.

Fixed an issue where a process (devsrvr) stopped responding after you pushed a configuration from Panorama to a firewall.

Fixed an issue where the system log incorrectly reported intermittent certificate revocation list (CRL) fetches as successful even though the fetches were not successful.

Fixed an issue where a configured certificate profile was not visible from the web interface in

Network > Network Profiles > IKE Gateways > Add > General > Certificate Profile

.

Fixed an issue where BGP peers were not enabled when transitioning from Active/Passive to Active/Active or Active/Active to Active/Passive config on both IPv4 and IPv6 peer groups.

Fixed an intermittent issue where a process (useridd) incorrectly reported successful Ops commands and did not download Dynamic Address Group updates, which prevented virtual machines from updating Dynamic Address Groups.

Fixed an issue where a process (mgmtsrvr) stopped responding when another process (masterd) sent a signal interruption after you upgraded from a PAN-OS 9.0 release to a PAN-OS 9.1 release.

An enhancement was made to increase the pattern match limit to recognize applications and threats accurately.

Fixed an issue where Panorama displayed incorrect device monitoring values (

Panorama > Managed Devices > Health

) for the firewall.

Fixed an issue where an old GPRS tunneling protocol (GTP) event was unexpectedly freed when an update message arrived, causing a crash.

Fixed an issue where the firewall restarted when you unplugged the QSFP+ module from the High Speed Chassis Interconnect (HSCI) port.

A fix was made to address an improper authorization vulnerability in PAN-OS (CVE-2020-1998).

Fixed an issue where a firewall had a race condition in the error handling code in the write thread, causing memory corruption in the sslmgr session cache ring buffer.

An enhancement was made to enable you to set the signing algorithm to

sha-1

or

sha-256

in the Security Assertion Markup Language (SAML) message on the firewall.

Fixed an issue where VM-Series firewalls were unable to support the maximum number of tunnel interfaces due to less than expected memory allocation.

(

PA-3200 Series firewalls only

) Fixed an issue where incomplete core dump files were generated during dataplane process crashes, making the crash analysis difficult.