topic Re: PAN-OS 10.2 preferred release Vs. vulnerabilities in General Topics

PAN-OS 10.2 preferred release Vs. vulnerabilities

grenzi — Wed, 05 Mar 2025 09:40:30 GMT

Hello everyone,

maybe this is a silly question, but as far as I can see the current PAN-OS 10.2 preferred release dates back in november and does not include fixes for recently discovered vulnerabilities (CVE-2025-0108, for example). I usually put a vulnerability protection profile in front of my management networks, but this vulnerability is not covered by any threat prevention signature. To my understandings, this means that running the currently preferred release leaves the firewall vulnerable to this particular threat. Am I right or am I missing something?

Kind regards

Re: PAN-OS 10.2 preferred release Vs. vulnerabilities

kiwi — Wed, 05 Mar 2025 11:51:56 GMT

Hi @grenzi ,

Here's the advisory for CVE-2025-0108:

https://security.paloaltonetworks.com/CVE-2025-0108

You will find 10.2 versions listed here that are unaffected by the vulnerability.

Kind regards,

-Kim.

Re: PAN-OS 10.2 preferred release Vs. vulnerabilities

TomYoung — Wed, 05 Mar 2025 12:06:37 GMT

Hi @grenzi ,

That is a good point. I went ahead and upgraded to a fixed version since it is only a couple minor releases different. The only changes in the software will be vulnerability fixes. I don't know the exact process, but PANW always waits a while before marking a new release as preferred. I believe they look at the support cases for a little while to make sure there are no bad bugs in the code.

Thanks,

Tom

Re: PAN-OS 10.2 preferred release Vs. vulnerabilities

grenzi — Wed, 05 Mar 2025 12:12:45 GMT

Hi Kiwi, thank you. I know about the patch releases that fix this vulnerability; my only concern is that che currently preferred release is affected, so the solution is to install a "non preferred" release. Anyway I saw other similar questions on the community, for example: https://live.paloaltonetworks.com/t5/general-topics/cve-2025-0108/td-p/1220580

I'm not afraid of upgrading, it's only a matter of, let's say, consistence 🙂

Re: PAN-OS 10.2 preferred release Vs. vulnerabilities

OtakarKlier — Wed, 05 Mar 2025 15:21:21 GMT

Hello,

Here is what I do to see what gets patched etc. I first look a the vulnerability and see to what degree I am affected. If we look at CVE-2025-0108, the main issue is "an unauthenticated attacker with network access to the management web interface to bypass the authentication". Since I have my management interfaces protected by the PAN and policies allowed via user-id, its a very low impact for me. Meaning I only allow those who should/do have access already so not a big deal.

So if there was not a preferred release that has the patch applied, I could wait since the likelihood of this being exploited is extremely low to nonexistent.

Happy to discuss how to protect the management interface if you wish. Maybe I'll write and article on it?

Hope this helps.