A medium-severity vulnerability, CVE-2024-3386, has been identified in Palo Alto Networks PAN-OS software, affecting systems running this software. The issue arises from an incorrect string comparison that prevents Predefined Decryption Exclusions from functioning as intended, potentially causing traffic for unspecified domains to be unintentionally excluded from decryption. While specific types of affected systems are not detailed, it is important for users to be aware of this vulnerability and take necessary precautions.

How do I know if I'm affected?

If you're using Palo Alto Networks PAN-OS software and have configured Predefined Decryption Exclusions on your firewalls, you might be affected by the CVE-2024-3386 vulnerability. To check, look for configured exclusions in your firewall web interface (Device > Certificate Management > SSL Decryption Exclusions). The vulnerability affects certain versions of PAN-OS, but no specific Apple product versions are mentioned in relation to this issue.

What should I do if I'm affected?

If you're affected by the CVE-2024-3386 vulnerability, update your PAN-OS software to a fixed version, such as 9.0.17-h2, 9.1.17, or 10.0.13. Check your firewall web interface for configured exclusions (Device > Certificate Management > SSL Decryption Exclusions) and follow the Palo Alto Networks advisory for more guidance.

Is CVE-2024-3386 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-3386 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue, an incorrect string comparison in Palo Alto Networks PAN-OS software, was added to the National Vulnerability Database on April 10, 2024. There is no specified due date or required action, as the vulnerability is awaiting analysis. In simpler terms, the software has a flaw that affects its Predefined Decryption Exclusions feature, causing some internet traffic to be mistakenly excluded from decryption. This issue is fixed in later versions of the software.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-436 involves an interpretation conflict in Palo Alto Networks PAN-OS software, affecting its Predefined Decryption Exclusions feature.

For more details

CVE-2024-3386 is a medium-severity vulnerability in Palo Alto Networks PAN-OS software, affecting its Predefined Decryption Exclusions feature. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD or the links below.

• Palo Alto Networks Security Advisory