CVE-2024-3386
PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended
Severity
Medium 5.3
CVSS 3.1
Exploited
Not listed
EPSS
0.004
37.4th percentile
Discovered by
Third party
Vendor-published field
Published
Apr 10, 2024
Assigned by palo_alto
Description
An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.
Weakness: CWE-436
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | PAN-OS | Firewall / NGFW | cna-assigner |
Vendor-reported products (3)
- Palo Alto Networks · PAN-OS
- Palo Alto Networks · Cloud NGFW — vendor states not affected
- Palo Alto Networks · Prisma Access — vendor states not affected
Credit
Palo Alto Networks thanks Frederic De Vlieger for discovering and reporting this issue.
Vendor remediation
This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.