topic Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire? in Advanced Threat Prevention Discussions

Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

Netdata1 — Tue, 26 Dec 2023 13:27:32 GMT

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

PavelK — Mon, 26 Feb 2024 05:44:43 GMT

Hello @Netdata1

PAN-OS is not affected by this vulnerability. As per OSS listing: OSS Listing even latest PAN-OS is running OpenSSH 8.0p1, while this vulnerability affects versions 9.0p1 – 9.5p1.

Kind Regards

Pavel

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

AkashThangavel — Thu, 22 Feb 2024 08:02:10 GMT

Hi PavelK,

The KB article you provided contains a different CVE number. Please verify its accuracy. If the provided information is correct, kindly provide the rationale behind sharing that particular KB

regards,

Akash Thangavel

Network Security Engineer

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

PavelK — Mon, 26 Feb 2024 05:49:33 GMT

Hello @AkashThangavel

you are correct. The link for KB I provided was indeed incorrect. I have already edited my original post. Thank you for pointing this out!

Kind Regards

Pavel

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

ivanemoore — Tue, 09 Apr 2024 09:43:06 GMT

Where does the vulnerability say 9.0p1 – 9.5p1? According to NIST, it is "OpenSSH before 9.6".

https://nvd.nist.gov/vuln/detail/CVE-2023-51385

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

PavelK — Tue, 09 Apr 2024 23:27:59 GMT

Hello @ivanemoore

thanks for post.

You can find details for CVE-2023-51385 here: https://www.cybersecurity-help.cz/vdb/SB2023121905. I had the same impression that anything below 9.6 is affected, however this does not seem to be case. In the past I opened a TAC ticket for this and could confirm that PAN-OS is not affected by this vulnerability.

Kind Regards

Pavel

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

ivanemoore — Tue, 14 May 2024 19:19:49 GMT

Interesting. I got back this:

Our Team has performed assessment for CVE 2023-51385 on our PAN-OS versions
The CVE is impacted PANOS 10.2 and above which includes 11.2, 11.1, 11.0 and 10.2 as Redhat mentioned it is affected to RHEL8 which is using for 10.2 and above. We are also in the process of getting the fixes in each pan os trains.

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

PavelK — Sun, 19 May 2024 21:47:05 GMT

Hello @ivanemoore

thank you for update on this topic.

It looks like the information you shared is more up to date. Did Palo Alto mention whether they are going to list this vulnerability in security advisory?

Kind Regards

Pavel

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

lwalcher — Tue, 28 May 2024 15:40:51 GMT

@PavelK and @ivanemoore:

The https://security.paloaltonetworks.com/PAN-SA-2024-0001 Security Advisory claims the following for CVE-2023-51385: "The ssh configuration file on PAN-OS does not contain the vulnerable configuration settings. Therefore, PAN-OS is not affected."

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

ivanemoore — Tue, 28 May 2024 15:42:58 GMT

So, basically, Palo Alto is conflicting with themselves and don't know what they heck they are saying. Great.

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

lwalcher — Tue, 28 May 2024 17:07:10 GMT

I would tend to believe the Palo Alto Networks Product Security Assurance team's assessment listed above, not least because a quick read of the OpenSSH fix for this CVE at https://www.openssh.com/txt/release-9.6 indicates it's only a vulnerability when a "ProxyCommand, LocalCommand directive or 'match exec' predicate reference[s] the user or hostname via %u, %h or similar expansion token..."

I'm trying to imagine a scenario where the PAN-OS implementation of OpenSSH would have ever wanted to use those directives/predicates in their conf file(s) anyway....

But I hear you on the discrepancy coming from different parts of the vendor's organization. If you wanted to be absolutely sure, you could open a new TAC case referencing the original case and some of the references above, and request clarification from TAC?

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

S.Ho323833 — Mon, 23 Dec 2024 08:02:49 GMT

Hi,

May I know if there is any operational impact regarding this upgrade to OPENSSH 9.6 or later

Re: Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

AkashThangavel — Tue, 24 Dec 2024 05:59:03 GMT

We cannot upgrade OpenSSH separately in our PAN-OS version. The maximum OpenSSH version supported in our latest PAN-OS version (8.0p1) is as follows:

If you believe this OpenSSH version is vulnerable, please check with TAC for confirmation that the CVE number for OpenSSH will not affect our environment.

https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-11-0-open-source-software-oss-listing

regards,

Akash Thangavel