Nominated Discussion: What Cloud Services are Affected by CVE-2020-1982?

This Nominated Discussion Article is based on the post "What cloud services are affected by CVE-2020-1982?" by @KyungjunCHOE and answered by @AKuzhuppilly. Read on to see his response!

Dear Team,

When checking CVE-2020-1982 in Palo Alto Networks Security Advisories, we found the following text:

> These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure.
URL : https://security.paloaltonetworks.com/CVE-2020-1982

The above phrase includes CSP.

So does this mean that dynamic update and software update communicated with CSP are not possible on the OS affected by that vulnerability?

I would like to know the extent to which that vulnerability is affected.

If anyone knows please share with me

Thank you

Response:

Hello @KyungjunCHOE

CVE-2020-1982 pertains to a specific issue where PAN-OS communicates with cloud-delivered services using the insecure TLS 1.0 protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure.

If you check updates.paloaltonetworks.com using tools like ssllabs, you'll notice that TLS 1.0 and TLS 1.1 are enabled.

This issue has been resolved in PAN-OS versions 8.1.14, 9.0.9, 9.1.3, and all subsequent releases.

Additionally, please be aware that Palo Alto intends to discontinue support for TLS 1.0 in their cloud service endpoints on November 8, 2023. To ensure uninterrupted access to cloud-delivered services and updates, it is necessary to upgrade to PAN-OS 8.1.14, 9.0.9, 9.1.3, or newer versions.