CVEs that cannot be found in Palo Alto Advisories

[ineedhelp]

Hi there,

Does anyone know what does it mean generally for CVEs that cannot be found on Palo Alto Advisories?

Does it mean Palo Alto is not affected or the advisories has yet to update?

A few examples that cannot be found would be the following :

CVE-2022-26377
CVE-2022-28330
CVE-2022-28614
CVE-2022-28615
CVE-2022-29404
CVE-2022-31813
CVE-2022-30556
CVE-2022-30522
CVE-2022-22719
CVE-2022-22720
CVE-2022-22721
CVE-2022-23943

[aleksandar.astardzhiev]

Hi @ineedhelp ,

The shortest answer is that Palo Alto doesn't have official statement for those vulnerabilities. But this could be either because it doesn't effect any of the PAN products or it haven't published such yet.

In my experiance Palo Alto are relativly quick with publishing Secuity Advisories affecting their products, so  I would assume in this case it is because those CVEs are not affecting any of the PAN products.

I have checked couple of the examples you provide and it seems all of them are related to Apache server 2.4.52 and earlier.

Using the following link you can see that PAN-OS (for example) is using Apache server version 2.4.6

https://docs.paloaltonetworks.com/oss-listings