"ID","Severity","Title","Product","Applicable Versions","Affected","Unaffacted","Date published","Date updated","CVSS Base Score","Attack Vector","Attack Complexity","Privileges Required", "User Interaction", "Scope", "Confidentiality Impact", "Integrity Impact", "AvailabilityImpact","Problem","Solution","Workaround","URL" CVE-2021-44228,CRITICAL,"Impact of Log4j Vulnerabilities CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832","PAN-OS for Firewall and Wildfire,Prisma SD-WAN (CloudGenix),Cortex XSOAR,GlobalProtect App,Cortex XDR Agent,Prisma Cloud Compute,Prisma Cloud,Bridgecrew,WildFire Appliance,SaaS Security,WildFire Cloud,IoT Security,Cortex Xpanse,Prisma Access,Okyo Garde,User-ID Agent,PAN-OS,Expedition,Cortex Data Lake,Enterprise Data Loss Prevention,Exact Data Matching CLI,PAN-DB Private Cloud,Traps","WildFire Cloud WildFire Appliance User-ID Agent Traps SaaS Security Prisma SD-WAN (CloudGenix) Prisma Cloud Compute Prisma Cloud Prisma Access PAN-OS for Firewall and Wildfire PAN-OS 10.1 PAN-OS 10.0 PAN-OS 9.1 PAN-OS 9.0 PAN-OS 8.1 PAN-DB Private Cloud Okyo Garde IoT Security GlobalProtect App Expedition Exact Data Matching CLI Enterprise Data Loss Prevention Cortex XSOAR Cortex Xpanse Cortex XDR Agent Cortex Data Lake Bridgecrew","< 10.0.8-h8 on Panorama < 9.1.12-h3 on Panorama < 9.0.15 on Panorama < 2.1","all all all all all all all all all all 10.1.* on Panorama >= 10.0.8-h8 on Panorama >= 9.1.12-h3 on Panorama >= 9.0.15 on Panorama 8.1.* on Panorama all all all all all >= 2.1 all all all all all all",2021-12-10,2022-01-22T02:30:00.000Z,9.8,NETWORK,LOW,NONE,NONE,UNCHANGED,HIGH,HIGH,HIGH,"Apache Log4j Java library is vulnerable to a remote code execution vulnerability CVE-2021-44228, known as Log4Shell, and related vulnerabilities CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Log4Shell allows remote unauthenticated attackers with the ability to inject text into log messages to execute arbitrary code loaded from malicious servers with the privileges of the process utilizing Log4j. These products and services are not affected by Log4Shell: Bridgecrew, Cortex Data Lake, Cortex XDR agents, Cortex XSOAR, Cortex Xpanse, Enterprise Data Loss Prevention (DLP), Expedition, the GlobalProtect app, IoT Security, Okyo Garde, PAN-DB Private Cloud, PAN-OS software running on firewalls including VM and CN series, Prisma Access, Prisma Cloud, Prisma Cloud Compute, Prisma SD-WAN (CloudGenix), SaaS Security, Traps, User-ID Agent, WildFire Appliance (WF-500), and WildFire Cloud. We have determined that some configurations of Panorama appliances with PAN-OS 9.0, PAN-OS 9.1, and PAN-OS 10.0 are impacted by CVE-2021-44228 and CVE-2021-45046 through the use of Elasticsearch. Fixes were released on December 20, 2021 to address both vulnerabilities on impacted PAN-OS versions. Panorama appliances are not impacted by CVE-2021-45105 and CVE-2021-44832. NOTE: PAN-OS 8.1 and PAN-OS 10.1 versions for Panorama are not impacted by these issues. All versions of PAN-OS for firewalls and WildFire appliances are not affected. These vulnerabilities impact Exact Data Matching (EDM) CLI application versions 1.0 - 2.0 provided by Enterprise Data Loss Prevention (DLP). Enterprise DLP is not affected by these issues. The Palo Alto Networks Product Security Assurance team has completed evaluation of all products and services for these vulnerabilities. All cloud services with known possible impact have been remediated. At this time, our guidance and criteria for impacted Panorama appliances remain the same for all related vulnerabilities. The Exact Data Matching (EDM) CLI application should now be upgraded to EDM CLI version 2.1 or later versions.","These issues are fixed in PAN-OS 9.0.15, PAN-OS 9.1.12-h3, PAN-OS 10.0.8-h8, and all later PAN-OS versions for Panorama hardware and virtual appliances. NOTE: Though PAN-OS 10.1 is not impacted by the these vulnerabilities, the responsible Log4j code was removed for additional assurance from PAN-OS 10.1 versions for Panorama appliances starting with PAN-OS 10.1.4. If Panorama is running an impacted version of PAN-OS, and you would prefer to upgrade to PAN-OS 10.1, upgrade all appliances in affected Collector Groups to the latest PAN-OS 10.1 Preferred release (PAN-OS 10.1.3-h1 at time of publication) to remediate these issues. NOTE: Prisma Access customers should refer to the Prisma Access and Panorama version compatibility document before upgrading Panorama: https://docs.paloaltonetworks.com/compatibility-matrix/prisma-access/prisma-access-and-panorama-version-compatibility.html NOTE: Downgrading to PAN-OS 10.0 or earlier PAN-OS versions is not currently supported once Panorama is upgraded to PAN-OS 10.1. Workarounds are available that eliminate the exposure for these older versions of Panorama until they can be upgraded to a fixed version. For Enterprise Data Loss Prevention customers, these issues are fixed in Exact Data Matching (EDM) CLI application version 2.1 and all later EDM CLI versions. No updates for other Palo Alto Networks products are required at this time. Cortex XSOAR customers that have opted to deploy Elasticsearch in their environment should refer to the Elasticsearch announcement (ESA-2021-31) for remediation information. Elasticsearch 7.16 is not supported with Cortex XSOAR: https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476 Enable signatures for unique threat IDs 91991, 91994, 91995, 92001, and 92007 to block a number of known attacks against CVE-2021-44228 and CVE-2021-45046 across the network. These signatures block the first stage of the attack. Suitable egress filtering is key to blocking the second stage of the attack. Use App-ID for ‘ldap’ and ‘rmi-iiop’ to block all LDAP and RMI to or from untrusted networks and unexpected sources. SSL decryption needs to be enabled on the firewall to block known attacks over HTTPS. Customers with log4j in their environments should upgrade or apply workarounds suggested by respective vendors, and not rely only on the Threat Prevention signatures. See https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/ for more details on the Palo Alto Networks product capabilities to protect against attacks that exploit this issue.","For each Panorama hardware appliance and virtual appliance running in Panorama mode or Log Collector mode, that has also been part of a Collector Group, must be removed from their Collector Group in ‘Panorama > Collector Group > Custom-CG-Name > General' from the web interface. Once affected appliances are removed from all groups, a Panorama commit and Collector Group push for all affected Collector Groups must be performed. The Collector Groups should not be deleted before performing the Collector Group push for the affected Collector Groups, else the Collector Group push will fail to remove the appliances. NOTE: When this workaround is applied, logging and reporting features in Panorama will not work. All logs stored on the appliance will be lost once it is removed from the Collector Group. Finally, all appliances that were part of the Collector Group need to be restarted to stop the use of Elasticsearch. This eliminates the exposure to CVE-2021-44228 and CVE-2021-45046. You can restart the appliance by visiting ‘Panorama > Operations > Device Operations > Reboot Panorama’ from the web interface or by using the command ‘request restart system’ from the CLI. Once these steps are completed, you can verify that Elasticsearch has stopped and the appliance’s exposure to CVE-2021-44228 and CVE-2021-45046 has been removed, by running the command ‘show system software status | match elasticsearch’ from the CLI. Managed PAN-OS firewalls can be configured to forward logs to other servers until Panorama log collection functionality is restored. Alternate Log Forwarding options are detailed here: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/objects/objects-log-forwarding.html Follow the security best practices listed in ‘Protecting Panorama and Log Collector Inbound and Outbound Communications’ to reduce the risk of successful exploitation of CVE-2021-44228 and CVE-2021-45046 on Panorama appliances: https://live.paloaltonetworks.com/t5/general-articles/protecting-panorama-and-log-collector-inbound-and-outbound/ta-p/454071 Additionally, use ACLs to limit network access to Panorama to only trusted users and trusted networks and IP addresses. Use App-ID for ‘ldap’ and ‘rmi-iiop’ to block all LDAP and RMI traffic to and from untrusted networks or unexpected sources. No other workarounds or mitigations are available for Palo Alto Networks products at this time.",https://security.paloaltonetworks.com/CVE-2021-44228