CVE-2024-3386 - OpenCVE

An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2024-3386

History

No history.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2024-04-10T17:06:32.694Z

Updated: 2024-08-01T20:12:06.667Z

Reserved: 2024-04-05T17:40:19.116Z

Link: CVE-2024-3386

Vulnrichment

Updated: 2024-08-01T20:12:06.667Z

NVD

Status : Awaiting Analysis

Published: 2024-04-10T17:15:57.593

Modified: 2024-04-10T19:49:51.183

Link: CVE-2024-3386

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3386", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2024-04-05T17:40:19.116Z", "datePublished": "2024-04-10T17:06:32.694Z", "dateUpdated": "2024-08-01T20:12:06.667Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "9.0.17-h2", "status": "unaffected"}], "lessThan": "9.0.17-h2", "status": "affected", "version": "9.0.0", "versionType": "custom"}, {"changes": [{"at": "9.1.17", "status": "unaffected"}], "lessThan": "9.1.17", "status": "affected", "version": "9.1.0", "versionType": "custom"}, {"changes": [{"at": "10.0.13", "status": "unaffected"}], "lessThan": "10.0.13", "status": "affected", "version": "10.0.0", "versionType": "custom"}, {"changes": [{"at": "10.1.9-h3", "status": "unaffected"}], "lessThan": "10.1.9-h3", "status": "affected", "version": "10.1.0", "versionType": "custom"}, {"changes": [{"at": "10.1.10", "status": "unaffected"}], "lessThan": "10.1.10", "status": "affected", "version": "10.1.0", "versionType": "custom"}, {"changes": [{"at": "10.2.4-h2", "status": "unaffected"}], "lessThan": "10.2.4-h2", "status": "affected", "version": "10.2.0", "versionType": "custom"}, {"changes": [{"at": "10.2.5", "status": "unaffected"}], "lessThan": "10.2.5", "status": "affected", "version": "10.2.0", "versionType": "custom"}, {"changes": [{"at": "11.0.1-h2", "status": "unaffected"}], "lessThan": "11.0.1-h2", "status": "affected", "version": "11.0.0", "versionType": "custom"}, {"changes": [{"at": "11.0.2", "status": "unaffected"}], "lessThan": "11.0.2", "status": "affected", "version": "11.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "11.1.0"}]}, {"defaultStatus": "unaffected", "product": "Cloud NGFW", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "All"}]}, {"defaultStatus": "unaffected", "product": "Prisma Access", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "All"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device > Certificate Management > SSL Decryption Exclusions)."}], "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device > Certificate Management > SSL Decryption Exclusions)."}], "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Frederic De Vlieger for discovering and reporting this issue."}], "datePublic": "2024-04-10T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption."}], "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"}], "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"}], "impacts": [{"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "description": "CWE-436 Interpretation Conflict", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2024-04-10T17:06:32.694Z"}, "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-3386"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.<br>"}], "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.\n"}], "source": {"defect": ["PAN-208155"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-04-10T16:00:00.000Z", "value": "Initial publication"}], "title": "PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "palo_alto_networks", "product": "cloud_ngfw", "cpes": ["cpe:2.3:a:palo_alto_networks:cloud_ngfw:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "unaffected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "palo_alto_networks", "product": "prisma_access", "cpes": ["cpe:2.3:a:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "unaffected", "lessThan": "*", "versionType": "custom"}]}, {"vendor": "palo_alto_networks", "product": "pan-os", "cpes": ["cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "9.0.0", "status": "affected", "lessThan": "9.0.17-h2", "versionType": "custom"}, {"version": "9.1.0", "status": "affected", "lessThan": "9.1.17", "versionType": "custom"}, {"version": "10.0.00", "status": "affected", "lessThan": "10.0.13", "versionType": "custom"}, {"version": "10.1.0", "status": "affected", "lessThan": "10.1.9-h3", "versionType": "custom"}, {"version": "10.1.0", "status": "affected", "lessThan": "10.1.10", "versionType": "custom"}, {"version": "10.2.0", "status": "affected", "lessThan": "10.2.4-h2", "versionType": "custom"}, {"version": "10.2.0", "status": "affected", "lessThan": "10.2.5", "versionType": "custom"}, {"version": "11.0.0", "status": "affected", "lessThan": "11.0.1-h2", "versionType": "custom"}, {"version": "11.0.0", "status": "affected", "lessThan": "11.0.2", "versionType": "custom"}, {"version": "11.1.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-10T19:11:36.523628Z", "id": "CVE-2024-3386", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-07T15:13:59.508Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.667Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-3386", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-3386", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:06.667Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-10T19:11:36.523628Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:palo_alto_networks:cloud_ngfw:*:*:*:*:*:*:*:*"], "vendor": "palo_alto_networks", "product": "cloud_ngfw", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*"], "vendor": "palo_alto_networks", "product": "prisma_access", "versions": [{"status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*"], "vendor": "palo_alto_networks", "product": "pan-os", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.17-h2", "versionType": "custom"}, {"status": "affected", "version": "9.1.0", "lessThan": "9.1.17", "versionType": "custom"}, {"status": "affected", "version": "10.0.00", "lessThan": "10.0.13", "versionType": "custom"}, {"status": "affected", "version": "10.1.0", "lessThan": "10.1.9-h3", "versionType": "custom"}, {"status": "affected", "version": "10.1.0", "lessThan": "10.1.10", "versionType": "custom"}, {"status": "affected", "version": "10.2.0", "lessThan": "10.2.4-h2", "versionType": "custom"}, {"status": "affected", "version": "10.2.0", "lessThan": "10.2.5", "versionType": "custom"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.1-h2", "versionType": "custom"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.2", "versionType": "custom"}, {"status": "affected", "version": "11.1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-07T15:09:14.732Z"}}], "cna": {"title": "PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended", "source": {"defect": ["PAN-208155"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Frederic De Vlieger for discovering and reporting this issue."}], "impacts": [{"capecId": "CAPEC-148", "descriptions": [{"lang": "en", "value": "CAPEC-148 Content Spoofing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "PAN-OS", "versions": [{"status": "affected", "changes": [{"at": "9.0.17-h2", "status": "unaffected"}], "version": "9.0.0", "lessThan": "9.0.17-h2", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "9.1.17", "status": "unaffected"}], "version": "9.1.0", "lessThan": "9.1.17", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "10.0.13", "status": "unaffected"}], "version": "10.0.0", "lessThan": "10.0.13", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "10.1.9-h3", "status": "unaffected"}], "version": "10.1.0", "lessThan": "10.1.9-h3", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "10.1.10", "status": "unaffected"}], "version": "10.1.0", "lessThan": "10.1.10", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "10.2.4-h2", "status": "unaffected"}], "version": "10.2.0", "lessThan": "10.2.4-h2", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "10.2.5", "status": "unaffected"}], "version": "10.2.0", "lessThan": "10.2.5", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "11.0.1-h2", "status": "unaffected"}], "version": "11.0.0", "lessThan": "11.0.1-h2", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "11.0.2", "status": "unaffected"}], "version": "11.0.0", "lessThan": "11.0.2", "versionType": "custom"}, {"status": "unaffected", "version": "11.1.0"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Cloud NGFW", "versions": [{"status": "unaffected", "version": "All"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access", "versions": [{"status": "unaffected", "version": "All"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>", "base64": false}]}], "timeline": [{"lang": "en", "time": "2024-04-10T16:00:00.000Z", "value": "Initial publication"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.\n", "supportingMedia": [{"type": "text/html", "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.<br>", "base64": false}]}], "datePublic": "2024-04-10T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-3386"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.", "supportingMedia": [{"type": "text/html", "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "CWE-436 Interpretation Conflict"}]}], "configurations": [{"lang": "en", "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device > Certificate Management > SSL Decryption Exclusions).", "supportingMedia": [{"type": "text/html", "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device > Certificate Management > SSL Decryption Exclusions).", "base64": false}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2024-04-10T17:06:32.694Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3386", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:12:06.667Z", "dateReserved": "2024-04-05T17:40:19.116Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2024-04-10T17:06:32.694Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.1"}