PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services

Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered services. We do not believe that any communication is impacted as a result of known attacks against TLS 1.0. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.14; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. PAN-OS 7.1 is not impacted by this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

不充分的加密强度

Palo Alto Networks PAN-OS 加密问题漏洞

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一套为其防火墙设备开发的操作系统。 Palo Alto Networks PAN-OS中存在加密问题漏洞，该漏洞源于程序使用了弱加密协议TLS 1.0版本。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。以下产品及版本受到影响：PAN-OS 8.0版本，8.1.14之前的8.1版本，9.0.9之前的9.0版本，9.1.3之前的9.1版本。

N/A

N/A