Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.

A fix was made to address a Security Assertion Markup Language (SAML) authentication issue (CVE-2020-2021).

Fixed an issue where SSL connections were blocked if you enabled decryption with the option to block sessions that have expired certificates. This issue included servers that sent an expired AddTrust certificate authority (CA) in the certificate chain.

A fix was made to address a buffer overflow vulnerability in PAN-OS that allowed an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface (CVE-2020-2040).

Fixed an issue where Cortex Data Lake certificates on the firewall were not automatically renewed after the certificates expired.

Fixed an issue where the firewall generated critical system logs:

Fsck failed for Logging Raid Disk Pair

after downgrading from PAN-OS 9.0 to PAN-OS 8.1.

Fixed an issue where a configuration audit created a large number of opresult.out files, which filled up the session/pan/user_tmp directory in opt/pancfg. This caused a slow Panorama response until a device restart was performed or the files were manually deleted from the root of the device.

Fixed an issue where a process (varrcvr) stopped responding on the PA-7000 Series Log Forwarding Card (LFC) when it received a verdict from the WildFire cloud.

Fixed an issue where, after loading a saved configuration snapshot by API, a custom role-based administrator required Superuser privileges to perform a full commit.

(

VM-Series firewalls in Azure environment only

) Fixed an issue where a kernel panic in a Linux Integration Services (LIS) driver caused the firewall to reboot by itself.

Fixed an issue where Slot 8 path monitoring failure occurred due to a memory buildup in a process (logrcvr) that was caused by slow communication and connection between log forwarding and Cortex Data Lake.

Fixed an issue where the dataplane restarted during a commit when

Netflow

was enabled.

Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter,

pkt_recv_bad_group

, is incremented.

(

VM-Series firewalls only

) Fixed connection issues between IPv6 peers when the IPv6 neighbor cache was synchronized in an HA cluster where, after failover, the newly active firewall did not send multicast neighbor solicitation from its global unicast address.

Fixed an intermittent issue where the firewall used IP addresses instead of domain names for URL category lookup after upgrading to 9.0.6.

Fixed an issue in the URL process where a process (devsrvr) stopped responding.

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.

Fixed an issue where the firewall failed stateful inspection for GTP forward relocation requests greater than 1,500 bytes and could not parse Access Point Name (APN) information in forward relocation requests.

(

PA-5200 Series and PA-7000 Series firewalls only

) Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.

Fixed an issue where unique GlobalProtect portal profiles were not selected in the correct order.

Fixed an issue where a process (configd) restarted and administrators received one of the following error messages:

Timed out while getting config lock. Please try again

or

Please wait while the server reboots...

due to a database error.

Fixed a performance drop issue seen when using API to configure larger sets of objects (more than 25 objects).

Fixed an issue where, in a high availability (HA) active/active configuration in a virtual wire deployment with asymmetric traffic, decryption did not work for some sites.

Fixed an intermittent issue where logs were delayed or missing when querying for logs by applying filters. To leverage this fix, you must upgrade Panorama to 9.0.9 and the Cloud Services plugin to 1.6.0-h1.

Fixed a configuration lock issue where Panorama timed out due to a process (configd) being unable to read another process (mongod).

(

PA-7000 Series firewalls only

) Fixed an issue where hot swapping a PA-7000 100G NPC with a PA-7000 20G NPC caused packet buffer leak and slot restarts.

(

PA-7000 Series firewalls only, running with both a PA-7000 100G NPC and a PA-7000 20G NPC

) Fixed an issue where IPSec traffic caused dataplane restarts.

Fixed an issue where URL filtering used the IP address instead of the hostname, which led to incorrect URL categorization.

Fixed an issue where a process (configd) consistently restarted with the following error message:

virtual memory limit exceeded, restarting

due to a dynamic updates push from Panorama to multiple firewalls.

(

PA-3000 Series and PA-800 Series firewalls only

) Fixed an issue with insufficient memory allocation for configurations to accommodate the PAN-OS 9.0 Dynamic Address Group feature.

Fixed an issue where PA-7000 20GXM and PA-7000 20GQXM Network Processing Cards (NPCs) failed to process some sessions for Layer 7 inspection due to internal maximum threshold value that was not set.

Fixed an issue in Panorama where the Security policy

Target

displayed the serial number of the targeted device instead of the hostname.

(

PA-7000 Series with 100GB NPC only

) Fixed an issue during firewall bootup where the following error message:

Bootloader upgrade failed, ret 255

appeared when small form-factor pluggable (SFP) modules were installed.

Fixed an issue that prevented Panorama from being switched out of management-only mode when deployed in Amazon Web Services (AWS) instance types M5 and C5.

Fixed an issue with log collectors on Panorama where large index sizes caused higher CPU usage than expected when disk space usage was high.

Fixed an issue where the GlobalProtect gateway was unable to parse a large list of IP addresses assigned on a local machine.

Fixed an issue in Panorama where a memory leak occurred during an HA sync commit.

Fixed an issue where a process (devsrvr) restarted when it hit the limit of the number of custom patterns available in the allocated memory.

Fixed an issue on the Panorama Virtual Appliance where the

show interface all

CLI command did not list any output.

Fixed an issue where Session Initiation Protocol (SIP) messages were not parsed correctly when the packet was received in separate segments, which caused the receiver to receive corrupted messages.

Fixed an issue on the Panorama Virtual Appliance where SNMP Object IDs (OIDs) were missing for interfaces other than the

Management

interface.

Fixed an issue where the Terminal Server (TS) Agent disconnected on the firewall after a failover or reboot.

Fixed an issue where after making configuration changes and selecting

Preview Changes

, a 500 Internal Server Error message displayed due to a memory leak.

Fixed an issue where the policy order was not maintained when moved to a different device group.

(

PA-7000 Series and PA-3200 Series firewalls only

) Fixed an issue where when jumbo frames were enabled, the maximum transmission unit (MTU) size limit was lower than expected.

Fixed an issue in Panorama where custom region objects were not visible in the GlobalProtect Portal

External Gateway

drop-down.

Fixed an issue where scheduled reports did not run on a PA-7000 Series firewall not managed by Panorama after upgrade to 8.1.10 or 9.0.4 and later versions.

Made improvements to the log storage for VM-Series for NSX Panorama.

Fixed an issue where

Device > VM-Series

on the firewall web interface showed a blank screen.

Fixed an issue where the

Name

log filter (

Monitor > Logs > Traffic

) was not maintained when viewing the

Log Viewer

for a Security policy rule (

Policies > Security

) from the drop-down.

Fixed an issue when configuring Clientless VPN and executing the

portal-getconfig

CLI command where user groups were retrieved but were not freed, which caused a memory leak on a process (sslvpn).

Fixed an issue where reports from Panorama displayed the following messages:

Please wait...

and

Warning: Some of the devices are in High Speed Log Forwarding Mode

.

Fixed an issue on the firewalls where the FIB lookup routing test did not display all available paths on the web interface.

Fixed an issue where the management plane CPU on the firewall was high due to index generation on summary logs.

Fixed an issue on Panorama where Applications and Threats content update deployment failed due to the content version date check.

Fixed an issue on the firewalls where SNMP queries for panZoneTable listed details for only one zone when there were two zones with same names under different virtual systems.

Fixed an issue in Amazon Web Services (AWS) where Ethernet1/1 failed DHCP renewal after the hour.

Fixed an issue where a process (useridd) restarted due to a buffer overflow when the time-to-live (TTL) and

Idle Timeout

values were set to

Never

, a timing issue between user group context and a process (sysd) callback, and a group mapping issue when multiple group mappings fetched the same groups with different override domains.

Fixed an issue where the PAN-OS XML API inject was not working for IP address to user mappings or for the import of software, content, and plugins.

Fixed an issue where User-ID running on port 5007 responded with the default certificate and participated in mutual authentication after upgrading to PAN-OS 9.0, which exposed the default certificate on the firewall to third-party vulnerability scanners.

Fixed an issue where system log entries misspelled "client version" as "lient version", which made it difficult for syslog servers to find these entries.

Fixed an issue where a process (mgmtsrvr) stopped responding and was inaccessible through SSH or HTTPS until the firewall was power cycled.

Fixed an issue where reports for URLs were not generating the correct data output.

Fixed an issue where a process (rasmgr) restarted multiple times, which caused the firewall to reboot.

Fixed an issue where the /opt/pancfg partition became full due to a large amount of botnet reports that were not automatically deleted.

Fixed an issue where the dataplane restarted when many NAT rules were followed by successive commits.

Fixed an issue where URL information in a URL

Custom Report

was blank when the report contained flexible size fields (such as

URL Category List

).

Fixed an issue where, during Antivirus or Threat Content update downloads or install, some show commands in the CLI, API calls, and web interface pages gave information output with significant delay (15-60 seconds).

Added two ciphers for GlobalProtect Portal TLS connections.

Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.

(

PA-3000 Series firewalls only

) Fixed an issue where a configuration commit failed due to a memory allocation failure on the dataplane.

Fixed an issue where traffic failed to match Security policies using wildcard address objects.

Fixed an issue on Panorama where a query (

after-change-preview contains

) did not return the expected results for configuration logs.

Fixed an issue in Panorama where certificate import failed with the following error message:

Certificate chain cannot be validated, required CAs not found

.

Fixed an issue where a commit from a Panorama appliance running PAN-OS 9.1 to a managed firewall running PAN-OS 9.0 or earlier failed with the following error message in ms.log:

error generating tranform ike-pre-transform.xsl

.

Fixed an issue where the firewall did not fail over to the secondary LDAP server when the primary LDAP server was not reachable and the configured LDAP bind timeout was not properly honored when SSL protocol was used.

Fixed an issue where the

to

,

from

, and

subject

fields did not populate in the threat logs if the fields were out of order.

Fixed an issue where email header information intermittently was not present in threat logs.

Fixed an issue where a process (panio) used unnecessary memory and caused an out-of-memory (OOM) condition on the dataplane if the dataplane was already low on memory.

Fixed an issue where Panorama did not display managed devices when selecting

Revert Content

(

Panorama > Device Deployment > Dynamic Updates

).

Fixed an issue where if one invalid FQDN object was configured, FQDN resolution failed for all FQDN objects.

Fixed an issue where a process (useridd) restarted while updating user groups. This issue occurred when multiple group mapping profiles were used to fetch the same group information while using different domain override settings.

Fixed an issue where a process (configd) crashed while making configuration changes on Panorama.

Fixed an issue where a process (mgmtsrvr) stopped responding due to a memory corruption issue when acquiring a configuration lock.

Fixed an issue where the firewall did not process the TLS record in SSL Inbound Inspection as expected, which introduced out-of-order packets in the transmit stage packet capture and affected client performance while accessing HTTP video applications.

Fixed an issue with log reading performance when using WMI for server monitoring with PAN-OS integrated User-ID agent.

A fix was made to address a reflected cross-site scripting (XSS) vulnerability in the PAN-OS management web interface where, if a remote attacker was able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link, the attacker could execute arbitrary code JavaScript code in the administrator's browser and perform administrative actions (CVE-2020-2036).

Fixed an issue where Static, Connected, and Host routes were missing on the FIB table of the firewall in a passive state after 300 seconds of switch over.

Fixed an issue where threat

Name

field of a threat

Custom Report

displayed the threat ID instead of the threat name.

Fixed an issue on the firewall where the Application Command Center (ACC)

Network Activity

tab displayed the message

In Progress

and stopped responding.

Fixed an issue where Panorama ran out of memory due to high memory usage on a process (configd).

Fixed an issue where the dataplane crashed while freeing up memory due to a corrupted or long certificate field in the handshake.

Fixed an issue where the OSPF summary Link State Advertisement (LSA) for the default 0.0.0.0/0 route were not advertised by the Area Border Router (ABR).

Fixed an issue on an M-Series appliances in a high availability (HA) active/passive configuration where the schedules (

Device > Dynamic Updates

) were unresponsive after a failover or restart of Panorama.