topic CVE-2022-0778 OpenSSL infinite loop vulnerability in Advanced Threat Prevention Discussions

CVE-2022-0778 OpenSSL infinite loop vulnerability

JimMcGrady — Mon, 04 Apr 2022 02:34:01 GMT

CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778 (paloaltonetworks.com)

Further to this one, it mentions that Globalprotect is affected but doesnt say whether a client software update is required.

Do you know if the Globalprotect client will need updating?

Re: CVE-2022-0778 OpenSSL infinite loop vulnerability

Adrian_Jensen — Mon, 04 Apr 2022 15:16:51 GMT

The CVE says they are working on "fixes to remove the vulnerable code from our PAN-OS, GlobalProtect app, and Cortex XDR agent", so i am expecting GP client software as well as the PANOS. But yeah... kind of left us hanging in the initial CVE release saying to update to the "-hf" release... which doesn't exist yet, then later updating the CVE to "ETA April '22".