CVE-2020-1982 — Inadequate Encryption Strength in Palo Alto Networks Pan-os

CWE-326 — Inadequate Encryption Strength4 documents4 sources
Severity
4.8MEDIUMNVD
EPSS
0.2%
top 53.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedJul 8
Latest updateMay 24

Description

Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered services. We do not believe that any communication is impacted as a result of known attacks against TL…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.5

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.14+3
▶CVEListV5palo_alto_networks/pan-os9.1 — 9.1.3+3
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-hmg3-8432-r83c: Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1↗2022-05-24
▶
CVEList
PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services↗2020-07-08
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services↗2020-07-08
▶
CVE-2020-1982 — Inadequate Encryption Strength in Palo | cvebase