CVE-2021-3032: PAN-OS: Configuration secrets for log forwarding may be logged in system logs
First published: Wed Jan 13 2021(Updated: )
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks PAN-OS | >=8.1.0<8.1.18 | |
| Palo Alto Networks PAN-OS | >=9.0.0<9.0.12 | |
| Palo Alto Networks PAN-OS | >=9.1.0<9.1.4 | |
| Palo Alto Networks PAN-OS | >=10.0.0<10.0.1 |
Remedy
If the PAN-OS firewall is impacted, then you must clear the configuration file (/var/log/pan/logrcvr.log). This can be accomplished by running the following CLI command: "delete debug-log mp-log file logrcvr.log". This issue is fixed in PAN-OS 8.1.18, PAN-OS 9.0.12, PAN-OS 9.1.4, PAN-OS 10.0.1, and all later PAN-OS versions.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-3032?
CVE-2021-3032 is an information exposure through log file vulnerability in Palo Alto Networks PAN-OS software.
What is the severity of CVE-2021-3032?
The severity of CVE-2021-3032 is medium with a CVSS score of 4.4.
What is affected by CVE-2021-3032?
Palo Alto Networks PAN-OS software versions 8.1.0 through 8.1.18, 9.0.0 through 9.0.12, 9.1.0 through 9.1.4, and 10.0.0 through 10.0.1 are affected by CVE-2021-3032.
How does CVE-2021-3032 work?
CVE-2021-3032 allows configuration secrets for the 'http', 'email', and 'snmptrap' v3 log forwarding server profiles to be logged to the logrcvr.log system log.
How can CVE-2021-3032 be fixed?
Apply the necessary security patches or updates provided by Palo Alto Networks for the affected PAN-OS software versions.
- agent/type
- agent/softwarecombine
- agent/author
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/paloaltonetworks
- canonical/palo alto networks pan-os
- version/palo alto networks pan-os/8.1.0
- version/palo alto networks pan-os/9.0.0
- version/palo alto networks pan-os/9.1.0
- version/palo alto networks pan-os/10.0.0