CVE-2021-3048 PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage

Medium 5.9 Published 11 Aug 2021 Updated 16 Sep 2024

Invalid URLs in External Dynamic Lists cause the Device Server daemon to stop, leading to firewall outages and denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-3048?

CVE-2021-3048 is a medium-severity denial of service vulnerability in Paloaltonetworks Pan-Os, published on 11 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall stops processing traffic. This issue impacts: PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 8.1 and PAN-OS 10.1 versions are not impacted.

Weakness: CWE-20

Which versions are affected by CVE-2021-3048?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2021-3048?

No fix has been published for CVE-2021-3048 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-3048 being exploited?

There is no known exploitation of CVE-2021-3048 in the wild and no public exploit code.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-9g4g-449x-h99g.