PAN-SA-2020-0007 Informational: Third-party or open source vulnerabilities that do not impact Palo Alto Networks Products

Palo Alto Networks Security Advisories / PAN-SA-2020-0007

PAN-SA-2020-0007 Informational: Third-party or open source vulnerabilities that do not impact Palo Alto Networks Products

Severity 0 · NONE

Attack Vector Not applicable

Scope Not applicable

Attack Complexity Not applicable

Confidentiality Impact NONE

Privileges Required Not applicable

Integrity Impact NONE

User Interaction Not applicable

Availability Impact NONE

JSON

Published 2020-07-08

Updated 2022-04-05

Reference PAN-149916, PAN-137122, OSS-316 and PAN-147254

Discovered externally

Description

The Palo Alto Networks Product Security Assurance team has evaluated and determined that these third-party or open source vulnerabilities do not have any security impact on PAN-OS or that the scenarios required for successful exploitation do not exist on devices running a PAN-OS release.

The conditions required to exploit jQuery vulnerabilities CVE-2020-11022 and CVE-2020-11023 do not exist in PAN-OS software. However, out of an abundance of caution, the jQuery library was upgraded to a fixed version that does not contain the vulnerable code in PAN-OS 8.1.19, PAN-OS 9.0.13, PAN-OS 9.1.8, and all later PAN-OS versions.

CVE	CVSS	Summary
CVE-2020-11896	10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11897	10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11898	9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11899	5.4 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11900	8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11901	9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11902	7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11903	6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11904	7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11905	6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11906	6.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11907	6.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11908	4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11909	5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11910	5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11911	5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11912	5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11913	5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2020-11914	4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)	This vulnerability in Treck TCP/IP stack (also known as Ripple20) does not impact PAN-OS software.
CVE-2013-7459	9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)	This vulnerability in pycrypto does not affect PAN-OS software.
CVE-2018-1122	7.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)	Conditions required for exploiting this vulnerability in procps-ng do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2018-16402	9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)	Conditions required for exploiting this vulnerability in libelf do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2020-11022	6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)	Conditions required for exploiting this vulnerability in jQuery do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2020-11023	6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)	Conditions required for exploiting this vulnerability in jQuery do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2018-1121	5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)	Conditions required for exploiting this vulnerability in procps-ng do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2018-1120	5.3 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)	Conditions required for exploiting this vulnerability in procps-ng do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2018-1123	7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)	Conditions required for exploiting this vulnerability in procps-ng do not exist in PAN-OS software. Hence PAN-OS software is not impacted.
CVE-2018-1124	7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)	Conditions required for exploiting this vulnerability in procps-ng do not exist in PAN-OS software. Hence PAN-OS software is not impacted.

Product Status

Versions	Affected	Unaffected
PAN-OS all	None	all

Severity:NONE

CVSSv3.1 Base Score:0 (CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N)

Weakness Type

Solution

No product updates are required for these issues.

The jQuery library used in PAN-OS 8.1.19, PAN-OS 9.0.13, PAN-OS 9.1.8, and all later PAN-OS versions does not contain the vulnerable code used to exploit vulnerabilities CVE-2020-11022 and CVE-2020-11023.

Timeline

2022-04-05 Added versions of PAN-OS that upgrade jQuery to a fixed version

2020-07-08 Initial publication