CVE-2022-0028: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
First published: Wed Aug 10 2022(Updated: )
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
Credit: psirt@paloaltonetworks.com psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Paloaltonetworks Pan-os | >=8.1<8.1.23-h1 | |
| Paloaltonetworks Pan-os | >=9.0<9.0.16-h3 | |
| Paloaltonetworks Pan-os | >=9.1<9.1.14-h4 | |
| Paloaltonetworks Pan-os | >=10.0<10.0.11-h1 | |
| Paloaltonetworks Pan-os | >=10.1<10.1.6-h6 | |
| Paloaltonetworks Pan-os | >=10.2<10.2.2-h2 | |
| Palo Alto Networks PAN-OS | ||
| >=8.1<8.1.23-h1 | ||
| >=9.0<9.0.16-h3 | ||
| >=9.1<9.1.14-h4 | ||
| >=10.0<10.0.11-h1 | ||
| >=10.1<10.1.6-h6 | ||
| >=10.2<10.2.2-h2 |
Remedy
We identified workarounds to prevent the denial-of-service (DoS) attacks that result from this issue in certain Palo Alto Networks firewalls, with this policy configuration We intend to fix this issue for PA-Series, VM-Series and CN-Series firewalls with a fix in the following PAN-OS software releases: PAN-OS 8.1.23-h1 (ETA: week of August 8, 2022), PAN-OS 9.0.16-h3 (ETA: week of August 15, 2022), PAN-OS 9.1.14-h4 (ETA: week of August 15, 2022), PAN-OS 10.0.11-h1 (ETA: week of August 15, 2022), PAN-OS 10.1.6-h6 (ETA: week of August 8, 2022), and PAN-OS 10.2.2-h2 (ETA: week of August 15, 2022). We expect to release all PAN-OS software updates for this issue no later than the week of August 15, 2022.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-0028?
CVE-2022-0028 is a vulnerability in Palo Alto Networks PAN-OS that allows a network-based attacker to conduct reflected and amplified TCP denial-of-service attacks.
How does CVE-2022-0028 work?
CVE-2022-0028 occurs due to a URL filtering policy misconfiguration in PAN-OS, which enables attackers to launch reflected and amplified TCP denial-of-service attacks.
Are there any known affected software versions for CVE-2022-0028?
Yes, Palo Alto Networks PAN-OS versions 8.1.23-h1 to 10.2.2-h2 are affected by CVE-2022-0028.
What is the severity rating of CVE-2022-0028?
CVE-2022-0028 is rated as high severity with a CVSS score of 8.6.
How can I mitigate CVE-2022-0028?
To mitigate CVE-2022-0028, it is recommended to apply the necessary patches provided by Palo Alto Networks for PAN-OS versions 8.1.23-h1 to 10.2.2-h2.
- collector/nvd-index
- agent/type
- agent/description
- agent/title
- agent/weakness
- agent/remedy
- agent/severity
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/threatpost
- source/Threatpost
- alias/CVE-2022-0028
- agent/references
- agent/tags
- agent/event
- agent/trending
- vendor/paloaltonetworks
- canonical/paloaltonetworks pan-os
- version/paloaltonetworks pan-os/8.1
- version/paloaltonetworks pan-os/9.0
- version/paloaltonetworks pan-os/9.1
- version/paloaltonetworks pan-os/10.0
- version/paloaltonetworks pan-os/10.1
- version/paloaltonetworks pan-os/10.2
- vendor/palo alto networks
- canonical/palo alto networks pan-os