Vulnerability · Published Jul 8, 2020 · Assigned by palo_alto
CVE-2020-1982PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services
Medium 4.8
In plain English
A medium-severity security flaw in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered services. We do not believe that any communication is impacted as a result of known attacks against TLS 1.0. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.14; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. PAN-OS 7.1 is not impacted by this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | PAN-OS | 8.0.*9.1 – before 9.1.39.0 – before 9.0.98.1 – before 8.1.15 |
Weakness: CWE-326 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://security.paloaltonetworks.com/CVE-2020-1982 x_refsource_MISC