PT-2020-15202 · Palo Alto Networks · Pan-Os+2

Published 2020-07-08 · Updated 2020-07-14 · CVE-2020-1982

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PAN-OS versions 8.0 PAN-OS versions 8.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.8 PAN-OS versions 9.1 through 9.1.2

Description The issue arises from certain communication between PAN-OS and cloud-delivered services inadvertently using TLS 1.0, a cryptographically weak protocol. The affected cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Although TLS 1.0 weaknesses are known, the conditions required for their exploitation do not exist in this context, and it is believed that no communication is impacted by known attacks against TLS 1.0.

Recommendations For PAN-OS version 8.0, update to a version later than 8.0 to resolve the issue. For PAN-OS versions 8.1 through 8.1.13, update to PAN-OS 8.1.14 or later. For PAN-OS versions 9.0 through 9.0.8, update to PAN-OS 9.0.9 or later. For PAN-OS versions 9.1 through 9.1.2, update to PAN-OS 9.1.3 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2020-1982

Affected Products

Cortex Data Lake

Pan-Os

Prisma Access

References · 3

• https://security.paloaltonetworks.com/CVE-2020-1982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1982 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1982 · Vendor Advisory