PAN-OS 9.1.4 Addressed Issues

PAN-OS® 9.1.4 addressed issues.
Issue ID
Description
WF500-5320
Fixed an issue where the WF-500 cluster did not synchronize verdicts after successful verdict recheck queries with the WildFire global cloud.
PAN-151197
Fixed an issue where a process (authd) restarted when an administrator authenticated to the firewall with an Active Directory (AD) account. This issue occurred when LDAP was configured with FQDN, used DHCP instead of a static management IP address, and used the management interface to connect to the LDAP server.
PAN-150172
Fixed an issue where dataplane processes restarted when attempting to access websites that had the
NotBefore
attribute less than or equal to Unix Epoch Time in the server certificate with forward proxy enabled.
PAN-150170, PAN-150013, and PAN-149822
A fix was made to address an OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allowed authenticated administrators to disrupt system processes and execute arbitrary code and OS commands with root privileges (CVE-2020-2000).
PAN-149377
A fix was made to address a vulnerability regarding information exposure through log files in PAN-OS that made it possible for configuration secrets for HTTP, email, and SNMP trap v3 log forwarding server profiles to be logged to the logrcvr.log system log (CVE-2021-3032).
PAN-148806
A fix was made to address an uncontrolled resource consumption vulnerability in PAN-OS that allowed for a remote unauthenticated user to upload temporary files through the management web interface that were not properly deleted after the request was finished. An attacker could disrupt the availability of the management web interface by repeatedly uploading files until available disk space was exhausted (CVE-2020-2039).
PAN-148676
Fixed an issue where the
panlogs
directory reached 100% utilization on the firewall due to early calculation of the .size file.
PAN-148522
Fixed an issue for PAN-DB where certain situations caused performance issues.
PAN-147996
(
PA-7000b Series firewalls only
) Fixed a buffer overflow issue.
PAN-147399
Fixed an issue where Panorama in Legacy mode rebooted due to multiple process (reportd) restarts.
PAN-147258
Fixed an issue with one-way audio for inbound voice calls due to incorrect source port translation.
PAN-147203
Fixed an issue where API calls did not return the output for the operational command for running configurations.
PAN-146837
A fix was made to address a vulnerability involving information exposure through log files where sensitive fields were recorded in the configuration log without masking on PAN-OS software when the
after-change-detail
custom syslog field was enabled for configuration logs and the sensitive field appeared multiple times in one log entry. The first instance of the sensitive field was masked but subsequent instances were left in clear text (CVE-2020-2043).
PAN-146624
Fixed an issue where exporting logs from the web interface did not generate a system log entry.
PAN-146531
Fixed an issue where conversion from Panorama mode to logger mode was enabled even when an admin user named admin did not exist in the configuration, which caused access to the appliance to be lost.
PAN-146086
Fixed an issue for Amazon Web Services (AWS) types C5 and M5 where Panorama was unable to use NMVe storage.
PAN-145942
After upgrading to certain PAN-OS 8.1 and 9.0 versions, for certain configurations using dynamic routing without graceful restart and with Bidirectional Forwarding Detection (BFD) enabled, there was a longer traffic hit after an HA failover compared to previous versions. This was due to BFD incorrectly timing admin-down messages for the failover event.
PAN-145929
Fixed an issue where, after upgrading the passive firewall, the stream control transmission protocol (SCTP) sessions synced from the active firewall did not retain the rule information, and, after failover, SCTP stateful inspection did not work.
PAN-145422
Fixed an issue where a process (all_pktproc) restarted while processing SSL VPN sessions.
PAN-145302
Fixed an issue where the high availability (HA) peer device did not preserve its import configuration when the mode was active/active and VR sync was disabled.
PAN-145142
Fixed an issue where Panorama running 9.0.8 allowed a user with the admin role Device Group and Template to create templates and template stacks.
PAN-144882
Fixed an issue where the firewall generated critical system logs:
Fsck failed for Logging Raid Disk Pair
after downgrading from PAN-OS 9.0 to PAN-OS 8.1.
PAN-144804
Fixed an issue where the firewall generated GPRS tunneling protocol (GTP) logs for invalid GTP packets. This fix also implements a counter,
flow_gtp_invalid_ver
, where the invalid packets are counted.
PAN-144670
Fixed an issue where the multi-factor authentication (MFA) timestamp was not redistributed across the virtual system (vsys) when the IP address-to-user mapping type was
UIA
.
PAN-144613
Fixed an issue where, when previewing device group configurations from Panorama, invalid messages were returned. With this fix, the configuration preview no longer returns invalid messages.
PAN-144492
Fixed an issue where traffic matched an incorrect URL filtering profile due to a similarity in the MD5 hashes between the URL filtering profiles.
PAN-143705
Fixed an issue where delicensing a large number of devices from Panorama failed.
PAN-143686
Fixed an issue where a firewall running in FIPS mode was unable to download the GlobalProtect datafile even when a GlobalProtect license was installed and valid.
PAN-143644
Fixed an issue where traffic did not match an FQDN address group based policy.
PAN-143090
Fixed an issue where the firewall silently dropped TCP out-of-order packets.
PAN-142927
Fixed an issue where the locked users list grew too large, which caused 100% CPU usage on a process (authd). With this fix, locked users will be purged hourly if the lockout time for that user has expired.
PAN-142853
Fixed an issue on Panorama where commits failed, referring to a portion of the configuration that was not changed.
PAN-142523
Fixed an issue where application-based SD-WAN policy match did not work if application traffic was subjected to SSL decryption.
PAN-141515
Fixed an issue where a service object with a destination port that is pushed from Panorama displays as
[object Object]
on the firewall.
PAN-141099
Fixed an issue where the HTTP/2 stream method was no longer valid after overloading the same pointer to point to either the HTTP/2 stream or the proxy flow.
PAN-140747
Fixed an issue where the firewall failed to establish SFTP firewall-server connections when SSH decryption was enabled.
PAN-140494
Added a mechanism to detect corrupted or incorrect formats received on dataplane CPU. Such packets are dropped, and a counter,
pkt_recv_bad_group
, is incremented.
PAN-140272
Fixed an issue where RADIUS authentication failed when using an ampersand (&) in the RADIUS shared secret.
PAN-139764
Fixed an issue where an out-of-memory (OOM) condition occurred due to a memory leak, which caused a process (configd) to restart.
PAN-139680
Fixed an issue where dynamic route updates triggered an unintentional refresh of the DHCP client interface IP address, which led to the removal and re-addition of the default route associated with the DHCP client IP address and caused traffic disruption.
PAN-139587
(
PA-5200 Series and PA-7000 Series firewalls only
) Fixed an issue where high and continuous CPU utilization was seen on dataplanes after IPSec Encapsulating Security Payload (ESP) rekeying occurred for multiple tunnels.
PAN-139365
(
PA-7000 Series firewalls only
) Enhanced latency-sensitive protocols processing. With this fix, the following latency-sensitive control traffic will be prioritized: BGP, Bidirectional Forwarding Detection (BFD), LACP, OSPF, OSPFv3, Protocol Independent Multicast (PIM), and Internet Group Management Protocol (IGMP).
PAN-139264
Fixed an issue where the Elasticsearch cluster status displayed in yellow due to a missing replica serial number.
PAN-139172
Fixed an issue where response pages generated from the firewall used the SMAC and DMAC addresses from the original packet, which caused a MAC flap on connected switches.
PAN-138584
Fixed an issue that prevented the addition of a secondary logging disk for a VM-Series firewall deployed on Amazon Web Services (AWS) using Nitro server instance types.
PAN-137770
Fixed an issue where the dataplane restarted due to a loop in DoS protection source-destination IP address classification.
PAN-137661
Fixed an issue where certain packets destined to untagged subinterfaces were silently dropped on multi-dataplane platforms.
PAN-137138
Fixed an issue where a process (configd) consistently restarted with the following error message:
virtual memory limit exceeded, restarting
due to a dynamic updates push from Panorama to multiple firewalls.
PAN-136844
Fixed an issue for S11 traffic where if the Modify Bearer Request message came after 30 seconds of Create Session Response message, the firewall dropped the Modify Bearer Request packet. This fix increases this time to 90 seconds.
PAN-136650
Fixed an issue where a Log Collector remained in an out-of-sync state after configuring an IP address (local or public) on an additional Ethernet interface.
PAN-135889
Fixed an issue where GTP-U tunnel session was setup incorrectly on receiving Modify Bearer Requests/ Responses with multiple Bearer Context for different EBIs
PAN-135887
Fixed an issue where the inner GTP-U flows were installed using incorrect zones, which led to traffic issues if the firewall was in line for the S1-U interface.
PAN-135673
Fixed an issue where the firewall kept its connection to Cortex Data Lake even after the configuration had been disabled and the license was expired.
PAN-135134
Fixed an issue where using a
session_proxy()
without checking that it actually is a proxy led to a dataplane process restart.
PAN-134029
Fixed an intermittent issue on the firewall where H.225 VOIP signaling packets dropped.
PAN-132285
Fixed an intermittent issue where a Security policy with
Send ICMP Unreachable
enabled for certain drop or reset sessions caused a process (all-pktproc) to restart.
PAN-131474
A fix was made to address a vulnerability related to information exposure through log files in PAN-OS where the connection details for a scheduled configuration export were logged in system logs ( CVE-2021-3037).
PAN-129461
Fixed an issue where excessive next hop FPGA exceptions occurred when an ARP request or response was lost in the network in an ECMP configuration, which blocked subsequent ARP learning due to a full queue.
PAN-128650
Fixed an issue where selecting
Preview Changes
under a specific device group resulted in the following error message:
Parameter device group missing
.
PAN-123279
Fixed an issue where a process (configd) stopped responding after upgrading Panorama to 8.1.9 from 8.0.16 due to 8.0 WildFire appliance register requests.
PAN-115896
Fixed an issue where the static route path monitoring status was not viewable from the CLI or web interface and failed with the following error message:
failed to execute op command
.
PAN-114761
Fixed an issue where the log receiver failed to establish connections to Cortex Data Lake when it was unable to validate Cortex Data Lake certificates.
PAN-114264
Fixed an issue where sessions were offloaded as the application identification was performed when you configured a custom application with
Continue scanning for other application
.
PAN-113767
Fixed an issue where the firewall silently dropped packets when security profiles were attached and FPGA enabled AHO and DFA.
PAN-112972
Fixed an issue where scheduled reports were not generated as expected when you added groups in a query builder.
PAN-111333
An enhancement was made to increase the pattern match limit to recognize applications and threats accurately.
PAN-110685
Fixed a rare issue where an incorrect User-ID™ match to the respective LDAP group caused a security policy mismatch.
PAN-109894
Fixed an issue where, when DHCP requests were sent from a subinterface configured as a DHCP client, packets dropped due to improper handling of the ARP reply for the DHCP requests.
PAN-103865
Fixed an issue where the firewall did not detect user credentials when the number of users exceeded 60,000. To leverage this fix, you must upgrade Windows agents to User-ID agent <8.1.11 | 9.0.4> or a later User-ID agent <8.1 | 9.0> release.
PAN-101484
A fix was made to address an OS command injection vulnerability in the PAN-OS management interface that allowed authenticated administrators to execute arbitrary OS commands with root privileges (CVE-2020-2038).

Recommended For You