CVE-2020-1999: 
PAN-OS vulnerability analysis and mitigation

A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine (CVE-2020-1999) that allows an attacker to evade threat prevention signatures using specifically crafted TCP packets. The vulnerability was discovered internally by Palo Alto Networks and disclosed on November 11, 2020. The affected systems include PAN-OS versions 8.1 (earlier than 8.1.17), 9.0 (earlier than 9.0.11), 9.1 (earlier than 9.1.5), and all versions of PAN-OS 7.1 and PAN-OS 8.0 (Palo Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium severity) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality Impact: None, Integrity Impact: Low, and Availability Impact: None. The weakness type is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) (Palo Advisory).

This vulnerability has no impact on the confidentiality and availability of PAN-OS, and it does not allow attackers to access resources blocked by firewall policies. However, there could be an impact on the accuracy of firewall threat prevention with some signatures, though there is no impact on the integrity of other security features (Palo Advisory).

Palo Alto Networks has stated they are not aware of any malicious exploitation of this vulnerability in the wild (Palo Advisory).

The vulnerability has been fixed in PAN-OS versions 8.1.17, 9.0.11, 9.1.5, and all later PAN-OS versions. There are no known workarounds for this issue (Palo Advisory).