CVE-2021-44790 & CVE-2021-44224

Showing results for 
Show  only  | Search instead for 
Did you mean: 

CVE-2021-44790 & CVE-2021-44224

L0 Member

Hi All

we are using Paloalto firewall 3060 with OS version 8.1.7


is there any updated info regarding this vulnerability CVE-2021-44790 & CVE-2021-44224? Has Paloalto found a way to mitigate this vulnerability?



Please advise


L3 Networker

Hi there


I would do the following:

- for your inbound rule, from internet to DMZ and your webserver on App-ID ssl, or web-browsing if you’re doing ssl decryption, I would add URL as a match criteria. Add a custom URL category containing the FQDN based URLs for you website. and * This will prevent the scanners from abusing your website by purely using IP. With CVE-2021-44228 we’ve seen IP based scans, and this config would stop successful scans

- SSL Inbound Inspection. Use it for all your services, including for the internal services. By doing this you gain full visibility, for App-ID, and for IoC signatures. You are also then able to add even more granular URLs in your custom category in the match criteria

- I haven’t found details on how and what body headers needs to be modified to abuse this vulnerability, but the SSL decryption will make it possible to read these headers when the IPS signatures are to be available. 


Regards Zero Trust Soldier

thanks for your helpful response. All questions answered

slope game

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!