Palo Alto Networks Security Advisories / PAN-SA-2021-0001

PAN-SA-2021-0001 Informational: Cortex XSOAR: Impact of Golang XML parsing vulnerabilities

047910
Severity 0 · NONE
Attack Vector PHYSICAL
Attack Complexity HIGH
Privileges Required HIGH
User Interaction REQUIRED
Scope UNCHANGED
Confidentiality Impact NONE
Integrity Impact NONE
Availability Impact NONE

Description

The Palo Alto Networks Product Security Assurance team evaluated the vulnerabilities (CVE-2020-29509, CVE-2020-29510, and CVE-2020-29511) that impact the standard Golang XML parsing library.

All versions of Cortex XSOAR use a version of Golang that contains these vulnerabilities but there are no scenarios for successful exploitation of them in Cortex XSOAR.

As a result, there is no known security impact for these issues in Cortex XSOAR. However, out of an abundance of caution, we removed the impacted Golang code entirely from Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.2, and all later versions of Cortex XSOAR.

Product Status

VersionsAffectedUnaffected
Cortex XSOAR 6.0< 6.0.2>= 6.0.2
Cortex XSOAR 5.5None5.5.*

Severity: NONE

CVSSv3.1 Base Score: 0 (CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N)

Weakness Type

Solution

Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.2, and all later versions of Cortex XSOAR do not include the impacted Golang code.

Workarounds and Mitigations

Timeline

Initial publication
© 2020 Palo Alto Networks, Inc. All rights reserved.