topic Question about CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering (Severity: HIGH) in General Topics

Question about CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering (Severity: HIGH)

thanawat_l — Thu, 11 Aug 2022 10:55:37 GMT

Dear all,

PAN-OS

CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering (Severity: HIGH)

https://security.paloaltonetworks.com/CVE-2022-0028

About CVE-2022-0028 on Palo Alto vulnerability. If we have policy that config source with any because we use shared policy for all vsys. If we config source address with internal customer ip. It will have any effect from this vulnerability because if internet ip come to policy it will not match and go to deny policy.

Thank you for your answer.

Re: Question about CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering (Severity: HIGH)

S.Cantwell — Mon, 15 Aug 2022 15:49:31 GMT

Hello there

Security profiles are interpreted AFTER a security policy.
Why not create your rule with the internal IP BEFORE your current rule.

This way, your internal rule is matched first, and the remaining users will continue to hit the rule you currently have.
I guess I am thinking that you want a way to "whitelist" the internal IP. This is one way.
You can also white list the IP inside of the Vulnerability Profile itself, finding the ID number of the vulnerability and creating an Exception.