topic CVE-2021-44228 / Panorama in Panorama Discussions

CVE-2021-44228 / Panorama

securehops — Thu, 16 Dec 2021 01:03:25 GMT

As most are aware, Panorama running 9.x are affected by log4j vulnerability. The security advisory mentions "This issue is only applicable to Panorama hardware and virtual appliances that have run in Panorama Mode or Log Collector Mode as part of a Collector Group. Panoramas running in Management Only Mode are not impacted."

Does anyone know if Panoramas running in "legacy mode" are affected?

Re: CVE-2021-44228 / Panorama

singhpradeep25 — Thu, 16 Dec 2021 12:28:25 GMT

is PAN-OS v8.0.18 affected with log4j CVE-2021-44228 vulnerability ? Can anyone confirm me please .

Re: CVE-2021-44228 / Panorama

securehops — Thu, 16 Dec 2021 15:21:32 GMT

@singhpradeep25 not sure but 8.0 is end of life for almost 2 years now. I would recommend you upgrade

Re: CVE-2021-44228 / Panorama

PavelK — Thu, 16 Dec 2021 23:46:24 GMT

Hello @securehops

there was an update from Palo Alto regarding "Legacy" Panorama Mode: https://security.paloaltonetworks.com/CVE-2021-44228

It is listed as not impacted:

Panoramas running in Management Only mode or Legacy mode, including those used for Prisma Access, are not impacted.

Kind Regads

Pavel

Re: CVE-2021-44228 / Panorama

securehops — Fri, 17 Dec 2021 01:22:47 GMT

thanks @PavelK I confirmed the same with support today. Thanks for the link

Re: CVE-2021-44228 / Panorama

singhpradeep25 — Fri, 17 Dec 2021 09:48:40 GMT

@securehops @PavelK Thanks for quick response . I will upgrade it .