topic Re: Where is 5.2.13 for Windows? in GlobalProtect Discussions

Where is 5.2.13 for Windows?

EddieRowe — Fri, 06 May 2022 18:54:46 GMT

I am still looking/waiting on 5.2.13 to address the most recent security vulnerabilities. A couple of weeks ago they updated the bulletin to indicate the issue was not present in 5.2.13, but there is no 5.2.13 that I can find on Palo's site or on the actual firewall's software page. Surprised to see that 6.0.1 was released this week to address these security defects when I don't think anyone should be using any Palo 6.0 release.

Has anyone heard about the updated release? Or have I missed something and we are supposed to upgrade to an unstable 6.0.1 product as we always wait months after a new release?

Re: Where is 5.2.13 for Windows?

ydhanuka — Sat, 07 May 2022 11:07:55 GMT

Hi Eddie,

Which vulnerability you are looking to get a fix for ? the link below shows the known vulnerabilities and affected /unaffected version if you haven't check it already.

https://security.paloaltonetworks.com/?product=GlobalProtect+App&sort=-date

Re: Where is 5.2.13 for Windows?

Adrian_Jensen — Sat, 07 May 2022 18:11:27 GMT

He is referring to the OpenSSL infinity loop vulnerability, CVE-2022-0778. PA released the PANOS patch, but has not yet released the GP client patch. Was scheduled to be released "April 2022". Now saying the ETA is May 2022 for 5.x versions:

https://security.paloaltonetworks.com/CVE-2022-0778

Re: Where is 5.2.13 for Windows?

EddieRowe — Mon, 09 May 2022 15:28:54 GMT

CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778. GP 5.2.11 is vulnerable. Just surprised they fixed the issue in the 6.0 branch which no one should be using.

Re: Where is 5.2.13 for Windows?

ydhanuka — Tue, 10 May 2022 04:47:14 GMT

Yeah, the 6.0.1 has the fix for emergency use and 5.2.12 with the fix is expected sometime in May. Exact ETA will likely be not available since this will be subject to lots of QA processes before it is ready for release.

Re: Where is 5.2.13 for Windows?

EddieRowe — Tue, 10 May 2022 15:05:12 GMT

Thanks for sharing the new target date is this month. The info is in the security bulletin under the Solution section and is up to date as of 5/4/22.