CVE-2021-3032: PAN-OS: Configuration secrets for log forwarding may be logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 8.1.18 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 9.0.12 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 9.1.4 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.0.1 - Operational
If the PAN-OS firewall is impacted, clear the configuration file by running the CLI command to delete debug-log mp-log file logrcvr.log (clearing /var/log/pan/logrcvr.log).
Event History
Frequently Asked Questions
What is CVE-2021-3032?
CVE-2021-3032 is an information exposure through log file vulnerability in Palo Alto Networks PAN-OS software.
What is the severity of CVE-2021-3032?
The severity of CVE-2021-3032 is medium with a CVSS score of 4.4.
What is affected by CVE-2021-3032?
Palo Alto Networks PAN-OS software versions 8.1.0 through 8.1.18, 9.0.0 through 9.0.12, 9.1.0 through 9.1.4, and 10.0.0 through 10.0.1 are affected by CVE-2021-3032.
How does CVE-2021-3032 work?
CVE-2021-3032 allows configuration secrets for the 'http', 'email', and 'snmptrap' v3 log forwarding server profiles to be logged to the logrcvr.log system log.
How can CVE-2021-3032 be fixed?
Apply the necessary security patches or updates provided by Palo Alto Networks for the affected PAN-OS software versions.