Where is 5.2.13 for Windows?

[EddieRowe]

I am still looking/waiting on 5.2.13 to address the most recent security vulnerabilities.   A couple of weeks ago they updated the bulletin to indicate the issue was not present in 5.2.13, but there is no 5.2.13 that I can find on Palo's site or on the actual firewall's software page.  Surprised to see that 6.0.1 was released this week to address these security defects when I don't think anyone should be using any Palo 6.0 release. 

Has anyone heard about the updated release?  Or have I missed something and we are supposed to upgrade to an unstable 6.0.1 product as we always wait months after a new release?

[ydhanuka]

Hi Eddie,

Which vulnerability you are looking to get a fix for ? the link below shows the known vulnerabilities and affected /unaffected version if you haven't check it already.

https://security.paloaltonetworks.com/?product=GlobalProtect+App&sort=-date

[Adrian_Jensen]

He is referring to the OpenSSL infinity loop vulnerability, CVE-2022-0778. PA released the PANOS patch, but has not yet released the GP client patch. Was scheduled to be released "April 2022". Now saying the ETA is May 2022 for 5.x versions:

https://security.paloaltonetworks.com/CVE-2022-0778

[EddieRowe]

CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778. GP 5.2.11 is vulnerable. Just surprised they fixed the issue in the 6.0 branch which no one should be using.

[ydhanuka]

Yeah, the 6.0.1 has the fix for emergency use and 5.2.12 with the fix is expected sometime in May. Exact ETA will likely be not available since this will be subject to lots of QA processes before it is ready for release.

[EddieRowe]

Thanks for sharing the new target date is this month.   The info is in the security bulletin under the Solution section and is up to date as of 5/4/22.