topic CVE lodash.js in General Topics

CVE lodash.js

LizaRajjab — Tue, 23 Jul 2024 08:36:05 GMT

Hi,

Anyone can confirm if PAN OS affected with this CVE?

Lodash.js 4.17.20
CVE-2021-23337
CVE-2020-28500

Re: CVE lodash.js

JayGolf — Wed, 24 Jul 2024 16:50:27 GMT

You can check out the Palo Alto Networks Security Advisories for the information and remediations available for vulnerabilities concerning Palo Alto Networks products.

Re: CVE lodash.js

LizaRajjab — Mon, 12 Aug 2024 06:09:38 GMT

I use this link but not found. i got answer from TAC

PANOS is not affected by the CVE - CVE-2020-28500, CVE-2021-23337 and also currently we are in the non-affected lodash version "4.17.20". It's a false positive from the scanner side.