Clarification which update to use for CVE-2023-38802 (VM-100)

[BPSoftware]

Hi everyone. 

Just wondering on which update to apply for CVE-2023-38802 on a VM-100. 

The Palo CVE report CVE-2023-38802 PAN-OS: Denial-of-Service (DoS) Vulnerability in BGP Software (paloaltonetworks.com)

says any version under 10.2.6 is affected. 

However, the Recommended OS version page Support PAN-OS Software Release Guidance | Palo Alto Networks

suggested that it will be mitigated by 10.2.5. 

Am I misunderstanding somehow? 

[PavelK · Accepted solution]

Hello @BPSoftware

the CVE-2023-38802 is addressed in PAN-OS 10.2.6:

https://security.paloaltonetworks.com/CVE-2023-38802

I think the note information in preferred release page is only reference and not statement that 10.2.5 has addressed that issue.

Kind Regards

Pavel