Doubt about https://security.paloaltonetworks.com/CVE-2025-0108

[Alpalo]

Hi team

I have a PA 1420 passive active cluster with the preferred version 11.1.4-h7

However, reading the document:

https://security.paloaltonetworks.com/CVE-2025-0108

I am wondering if I am affected by this vulnerability or not, can anyone help me?

Best regards.

[kiwi]

Hi @Alpalo ,

The release notes don't mention this CVE in 11.1.4-h7.

The CVE is explicitly mentioned in the release notes of 11.1.6-h1

The advisory also mentions for 11.1.0 through 11.1.6 to upgrade to 11.1.6-h1 or later.

Based on this information I would assume 11.1.4-h7 is vulnerable yes.

Kind regards,

-Kim.

[BPry]

@Alpalo,

Part of the issue with having such a wide spread of releases being ran due to code quality issues. PAN just released 11.1.4-h13 which addresses this issue yesterday evening. If you want to stick on 11.1.4 that would be the hotfix that you're looking for. 

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/pan-os-11-1-4-known-and-addressed...

[palsoramas]

Hello,

What doesn't make much sense is that the version preferred by paloalto at the moment is version 11.1.4-h7 and that version is affected by a CVE. What do you think?

PAN-OS for Firewalls and Panorama

Currently Preferred Release	Preferred Date	Comments
11.1.4-h7	11/18/24	11.1 Release Notes

Best Regards