Nominated Discussion: What Cloud Services are Affected by CVE-2020-1982?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Community Team Member
No ratings

This Nominated Discussion Article is based on the post "What cloud services are affected by CVE-2020-1982?" by @KyungjunCHOE   and answered by @AKuzhuppilly. Read on to see his response!

 

Dear Team,

 

When checking CVE-2020-1982 in Palo Alto Networks Security Advisories, we found the following text:

> These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure.
URL : https://security.paloaltonetworks.com/CVE-2020-1982

 

The above phrase includes CSP.

 

So does this mean that dynamic update and software update communicated with CSP are not possible on the OS affected by that vulnerability?

 

I would like to know the extent to which that vulnerability is affected.

 

If anyone knows please share with me

 

Thank you

Response:

 

Hello @KyungjunCHOE

 

CVE-2020-1982 pertains to a specific issue where PAN-OS communicates with cloud-delivered services using the insecure TLS 1.0 protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure.

 

If you check updates.paloaltonetworks.com using tools like ssllabs, you'll notice that TLS 1.0 and TLS 1.1 are enabled. 

 

This issue has been resolved in PAN-OS versions 8.1.14, 9.0.9, 9.1.3, and all subsequent releases.

 

Additionally, please be aware that Palo Alto intends to discontinue support for TLS 1.0 in their cloud service endpoints on November 8, 2023. To ensure uninterrupted access to cloud-delivered services and updates, it is necessary to upgrade to PAN-OS 8.1.14, 9.0.9, 9.1.3, or newer versions.

 

Rate this article:
  • 2073 Views
  • 0 comments
  • 0 Likes
  • 270 Subscriptions
Register or Sign-in
Labels
Article Dashboard
Version history
Last Updated:
‎04-18-2024 12:39 PM
Updated by: