CVE-2024-47076 Informational: No Impact of CUPS Vulnerabilities on Palo Alto Networks Products
Informational
Description
The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-47076, CVE-2024-47177, CVE-2024-47175, and CVE-2024-47176 in the Common UNIX Printing System (CUPS) as they relate to our products.
Based on current information, Palo Alto Networks products and cloud services do not contain affected CUPS-related software packages and are not impacted by these issues.
| CVE | Summary |
|---|---|
| CVE-2024-47076 | The listed products do not contain affected CUPS-related software packages and are not impacted by this issue. |
| CVE-2024-47177 | The listed products do not contain affected CUPS-related software packages and are not impacted by this issue. |
| CVE-2024-47175 | The listed products do not contain affected CUPS-related software packages and are not impacted by this issue. |
| CVE-2024-47176 | The listed products do not contain affected CUPS-related software packages and are not impacted by this issue. |
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| Cortex XDR | None | All |
| Cortex XDR Agent | None | All |
| Cortex XSIAM | None | All |
| Cortex XSOAR | None | All |
| GlobalProtect App | None | All |
| PAN-OS | None | All |
| Prisma Access | None | All |
| Prisma Access Browser | None | All |
| Prisma Cloud | None | All |
| Prisma Cloud Compute | None | All |
| Prisma SD-WAN | None | All |
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Solution
No software updates are required at this time.
Workarounds and Mitigations
Customers who decide to block CUPS traffic can create a Security policy rule (Policies > Security) that targets the "cups" application. Refer to the information about creating Security policy rules: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/security-policy/create-a-security-policy-rule