CVE-2024-9472
Nov. 15, 2024, 1:58 p.m.
Tags
Product(s) Impacted
Palo Alto Networks PAN-OS
- 10.2.7-h12
- 10.2.8-h10
- 10.2.9-h9
- 10.2.9-h11
- 10.2.10-h2
- 10.2.10-h3
- 10.2.11
- 10.2.11-h1
- 10.2.11-h2
- 10.2.11-h3
- 11.1.2-h9
- 11.1.2-h12
- 11.1.3-h2
- 11.1.3-h4
- 11.1.3-h6
- 11.2.2
- 11.2.2-h1
Description
A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected. This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series running these specific versions of PAN-OS: * 10.2.7-h12 * 10.2.8-h10 * 10.2.9-h9 * 10.2.9-h11 * 10.2.10-h2 * 10.2.10-h3 * 10.2.11 * 10.2.11-h1 * 10.2.11-h2 * 10.2.11-h3 * 11.1.2-h9 * 11.1.2-h12 * 11.1.3-h2 * 11.1.3-h4 * 11.1.3-h6 * 11.2.2 * 11.2.2-h1
Weaknesses
CWE-476
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
CWE ID: 476Date
Published: Nov. 14, 2024, 10:15 a.m.
Last Modified: Nov. 15, 2024, 1:58 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
psirt@paloaltonetworks.com