Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Does vulnerability-CVE-2023-51385 have any impact on PanOS firewalls, Panorama or Wildfire?

L0 Member

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello @Netdata1

 

PAN-OS is not affected by this vulnerability. As per OSS listing: OSS Listing even latest PAN-OS is running OpenSSH 8.0p1, while this vulnerability affects versions 9.0p1 – 9.5p1.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

10 REPLIES 10

Cyber Elite
Cyber Elite

Hello @Netdata1

 

PAN-OS is not affected by this vulnerability. As per OSS listing: OSS Listing even latest PAN-OS is running OpenSSH 8.0p1, while this vulnerability affects versions 9.0p1 – 9.5p1.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi PavelK,

 

The KB article you provided contains a different CVE number. Please verify its accuracy. If the provided information is correct, kindly provide the rationale behind sharing that particular KB

 

regards,

Akash Thangavel

Network Security Engineer

Akash Thangavel, Network Security Engineer

Cyber Elite
Cyber Elite

Hello @AkashThangavel

 

you are correct. The link for KB I provided was indeed incorrect. I have already edited my original post. Thank you for pointing this out!

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Where does the vulnerability say 9.0p1 – 9.5p1?   According to NIST, it is "OpenSSH before 9.6".

 

https://nvd.nist.gov/vuln/detail/CVE-2023-51385

 

 

 

 

Cyber Elite
Cyber Elite

Hello @ivanemoore

 

thanks for post.

 

You can find details for CVE-2023-51385 here: https://www.cybersecurity-help.cz/vdb/SB2023121905. I had the same impression that anything below 9.6 is affected, however this does not seem to be case. In the past I opened a TAC ticket for this and could confirm that PAN-OS is not affected by this vulnerability.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Interesting.  I got back this:

 

Our Team has performed assessment for CVE 2023-51385 on our PAN-OS versions 
The CVE is impacted PANOS 10.2  and above which includes 11.2, 11.1, 11.0 and 10.2 as Redhat mentioned it is affected to RHEL8 which is using for 10.2 and above.  We are also in the process of getting the fixes in each pan os trains.

 

 

 

Cyber Elite
Cyber Elite

Hello @ivanemoore

 

thank you for update on this topic.

 

It looks like the information you shared is more up to date. Did Palo Alto mention whether they are going to list this vulnerability in security advisory?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L1 Bithead

@PavelK and @ivanemoore:

The https://security.paloaltonetworks.com/PAN-SA-2024-0001 Security Advisory claims the following for CVE-2023-51385: "The ssh configuration file on PAN-OS does not contain the vulnerable configuration settings. Therefore, PAN-OS is not affected."

So, basically, Palo Alto is conflicting with themselves and don't know what they heck they are saying.  Great.

 

L1 Bithead

I would tend to believe the Palo Alto Networks Product Security Assurance team's assessment listed above, not least because a quick read of the OpenSSH fix for this CVE at https://www.openssh.com/txt/release-9.6 indicates it's only a vulnerability when a "ProxyCommand, LocalCommand directive or 'match exec' predicate reference[s] the user or hostname via %u, %h or similar expansion token..."

I'm trying to imagine a scenario where the PAN-OS implementation of OpenSSH would have ever wanted to use those directives/predicates in their conf file(s) anyway....

But I hear you on the discrepancy coming from different parts of the vendor's organization. If you wanted to be absolutely sure, you could open a new TAC case referencing the original case and some of the references above, and request clarification from TAC?

  • 1 accepted solution
  • 10763 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!