Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.

Fixed an issue where a process (authd) restarted when an administrator authenticated to the firewall with an Active Directory (AD) account. This issue occurred when LDAP was configured with FQDN, used DHCP instead of a static management IP address, and used the management interface to connect to the LDAP server.

Fixed an issue where dataplane processes restarted when attempting to access websites that had the

NotBefore

attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.

A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges (CVE-2020-2000).

A fix was made to address a vulnerability regarding information exposure through log files in PAN-OS that made it possible for configuration secrets for HTTP, email, and SNMP trap v3 log forwarding server profiles to be logged to the logrcvr.log system log (CVE-2021-3032).

A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted (CVE-2020-2039).

Fixed an issue where the

panlogs

directory reached 100% utilization on the firewall due to early calculation of the .size file.

Fixed an issue for PAN-DB where certain situations caused performance issues.

(

PA-7000b Series firewalls only

) Fixed a buffer overflow issue.

Fixed an issue where Panorama in Legacy mode rebooted due to multiple process (reportd) restarts.

Fixed an issue with one-way audio for inbound voice calls due to incorrect source port translation.

Fixed an issue where API calls did not return the output for the operational command for running configurations.

A fix was made to address a vulnerability involving information exposure through log files where sensitive fields were recorded in the configuration log without masking on PAN-OS software when the

after-change-detail

custom syslog field was enabled for configuration logs and the sensitive field appeared multiple times in one log entry. The first instance of the sensitive field was masked but subsequent instances were left in clear text (CVE-2020-2043).

Fixed an issue where exporting logs from the web interface did not generate a system log entry.

Fixed an issue where conversion from Panorama mode to logger mode was enabled even when an admin user named admin did not exist in the configuration, which caused access to the appliance to be lost.

Fixed an issue for Amazon Web Services (AWS) types C5 and M5 where Panorama was unable to use NMVe storage.

After upgrading to certain PAN-OS 8.1 and 9.0 versions, for certain configurations using dynamic routing without graceful restart and with Bidirectional Forwarding Detection (BFD) enabled, there was a longer traffic hit after an HA failover compared to previous versions. This was due to BFD incorrectly timing admin-down messages for the failover event.

Fixed an issue where, after upgrading the passive firewall, the stream control transmission protocol (SCTP) sessions synced from the active firewall did not retain the rule information, and, after failover, SCTP stateful inspection did not work.

Fixed an issue where a process (all_pktproc) restarted while processing SSL VPN sessions.

Fixed an issue where the high availability (HA) peer device did not preserve its import configuration when the mode was active/active and VR sync was disabled.

Fixed an issue where Panorama running 9.0.8 allowed a user with the admin role Device Group and Template to create templates and template stacks.

Fixed an issue where the firewall generated critical system logs:

Fsck failed for Logging Raid Disk Pair

after downgrading from PAN-OS 9.0 to PAN-OS 8.1.

Fixed an issue where the firewall generated GPRS tunneling protocol (GTP) logs for invalid GTP packets. This fix also implements a counter,

flow_gtp_invalid_ver

, where the invalid packets are counted.

Fixed an issue where the multi-factor authentication (MFA) timestamp was not redistributed across the virtual system (vsys) when the IP address-to-user mapping type was

UIA

.

Fixed an issue where, when previewing device group configurations from Panorama, invalid messages were returned. With this fix, the configuration preview no longer returns invalid messages.

Fixed an issue where traffic matched an incorrect URL filtering profile due to a similarity in the MD5 hashes between the URL filtering profiles.

Fixed an issue where delicensing a large number of devices from Panorama failed.

Fixed an issue where a firewall running in FIPS mode was unable to download the GlobalProtect datafile even when a GlobalProtect license was installed and valid.

Fixed an issue where traffic did not match an FQDN address group based policy.

Fixed an issue where the firewall silently dropped TCP out-of-order packets.

Fixed an issue where the locked users list grew too large, which caused 100% CPU usage on a process (authd). With this fix, locked users will be purged hourly if the lockout time for that user has expired.

Fixed an issue on Panorama where commits failed, referring to a portion of the configuration that was not changed.

Fixed an issue where application-based SD-WAN policy match did not work if application traffic was subjected to SSL decryption.

Fixed an issue where a service object with a destination port that is pushed from Panorama displays as

[object Object]

on the firewall.

Fixed an issue where the HTTP/2 stream method was no longer valid after overloading the same pointer to point to either the HTTP/2 stream or the proxy flow.

Fixed an issue where the firewall failed to establish SFTP firewall-server connections when SSH decryption was enabled.

Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter,

pkt_recv_bad_group

, is incremented.

Fixed an issue where RADIUS authentication failed when using an ampersand (&) in the RADIUS shared secret.

Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.

Fixed an issue where dynamic route updates triggered an unintentional refresh of the DHCP client interface IP address, which led to the removal and re-addition of the default route associated with the DHCP client IP address and caused traffic disruption.

(

PA-5200 Series and PA-7000 Series firewalls only

) Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.

(

PA-7000 Series firewalls only

) Enhanced latency-sensitive protocols processing. With this fix, the following latency-sensitive control traffic will be prioritized: BGP, Bidirectional Forwarding Detection (BFD), LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM), and Internet Group Management Protocol (IGMP).

Fixed an issue where the Elasticsearch cluster status displayed in yellow due to a missing replica serial number.

Fixed an issue where response pages generated from the firewall used the SMAC and DMAC addresses from the original packet, which caused a MAC flap on connected switches.

Fixed an issue that prevented the addition of a secondary logging disk for a VM-Series firewall deployed on Amazon Web Services (AWS) using Nitro server instance types.

Fixed an issue where the dataplane restarted due to a loop in DoS protection source-destination IP address classification.

Fixed an issue where certain packets destined to untagged subinterfaces were silently dropped on multi-dataplane platforms.

Fixed an issue where a process (configd) consistently restarted with the following error message:

virtual memory limit exceeded, restarting

due to a dynamic updates push from Panorama to multiple firewalls.

Fixed an issue for S11 traffic where if the Modify Bearer Request message came after 30 seconds of Create Session Response message, the firewall dropped the Modify Bearer Request packet. This fix increases this time to 90 seconds.

Fixed an issue where a Log Collector remained in an out-of-sync state after configuring an IP address (local or public) on an additional Ethernet interface.

Fixed an issue where GTP-U tunnel session was setup incorrectly on receiving Modify Bearer Requests/ Responses with multiple Bearer Context for different EBIs

Fixed an issue where the inner GTP-U flows were installed using incorrect zones, which led to traffic issues if the firewall was in line for the S1-U interface.

Fixed an issue where the firewall kept its connection to Cortex Data Lake even after the configuration had been disabled and the license was expired.

Fixed an issue where using a

session_proxy()

without checking that it actually is a proxy led to a dataplane process restart.

Fixed an intermittent issue on the firewall where H.225 VOIP signaling packets dropped.

Fixed an intermittent issue where a Security policy with

Send ICMP Unreachable

enabled for certain drop or reset sessions caused a process (all-pktproc) to restart.

A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where the connection details for a scheduled configuration export were logged in system logs ( CVE-2021-3037).

Fixed an issue where excessive next hop FPGA exceptions occurred when an ARP request or response was lost in the network in an ECMP configuration, which blocked subsequent ARP learning due to a full queue.

Fixed an issue where selecting

Preview Changes

under a specific device group resulted in the following error message:

Parameter device group missing

.

Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.

Fixed an issue where the static route path monitoring status was not viewable from the CLI or web interface and failed with the following error message:

failed to execute op command

.

Fixed an issue where the log receiver failed to establish connections to Cortex Data Lake when it was unable to validate Cortex Data Lake certificates.

Fixed an issue where sessions were offloaded as the application identification was performed when you configured a custom application with

Continue scanning for other application

.

Fixed an issue where the firewall silently dropped packets when security profiles were attached and FPGA enabled AHO and DFA.

Fixed an issue where scheduled reports were not generated as expected when you added groups in a query builder.

An enhancement was made to increase the pattern match limit to recognize applications and threats accurately.

Fixed a rare issue where an incorrect User-ID™ match to the respective LDAP group caused a security policy mismatch.

Fixed an issue where, when DHCP requests were sent from a subinterface configured as a DHCP client, packets dropped due to improper handling of the ARP reply for the DHCP requests.

Fixed an issue where the firewall did not detect user credentials when the number of users exceeded 60,000. To leverage this fix, you must upgrade Windows agents to User-ID agent <8.1.11 | 9.0.4> or a later User-ID agent <8.1 | 9.0> release.