BugZero | Palo Alto Networks BugID PAN-145133 - A fix was made to address a vulnerability in the P...

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Overall: 6.3

Severity: 6.4

Community: 3.7

Lifecycle: 10.0

What is the BugZero Risk Score?

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Bug Details

Description

Disclaimer

Known affected versions were inferred from fixed-version data and were not explicitly confirmed by the vendor: 8.1.16, 9.1.4

The earliest recollection of this bug is traced back to PAN-OS 8.1.17 - July 22, 2025. This bug is fixed in PAN-OS versions 9.1.5, 8.1.17. A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ). For more information: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-17-addressed-issues https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-5-addressed-issues

Change history

Top Palo Alto Networks Defects

6.3Defect ID: PAN-305480
Fixed an issue where the pan_task process stopped responding while processing DoH JSON format traffic with DoH Security enabled, which caused missing cross-packet bytes in the decoded DNS query type field, and the dataplane went down.
6.3Defect ID: PAN-306534
Fixed an issue were the all_task process repeatedly restarted due to memory pool corruption when processing fragmented DNS over HTTPs (DoH) JSON queries. This occurred due to incorrect buffer length calculations during memory deallocation when the query name field spanned multiple packets.
6.3Defect ID: PAN-282640
Fixed an issue where custom reports showed incomplete data when exported in CSV format from Panorama.
6.3Defect ID: PAN-292447
Fixed an issue where Panorama did not display data in the Feature Adoption tab in Strata Cloud Manager due to the system creating and deleting a CLI user for each interval instead of reusing a permanent CLI user for telemetry.
6.3Defect ID: PAN-296478
Fixed an issue where, after upgrading to PAN-OS 10.2.13-h10, GlobalProtect Clientless VPN on PA-3250 firewalls failed to execute JavaScript links, resulting in an authorization error. This occurred because the firewall was incorrectly injecting text into URLs when JavaScript buttons or dropdown menus were clicked within the Clientless VPN portal.

Palo Alto Networks Integration

Learn more about where this data comes from

Palo Alto Networks Integration

Learn more

BugZero Plan

Streamline upgrades with automated vendor bug scrubs

BugZero Plan

Learn more

BugZero Prevent

Wish you caught this bug sooner? Get proactive today.

BugZero Prevent

Learn more

Ready to prevent the next vendor outage?

Get a demo

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Last updated on July 22nd, 2025

BugZero Risk Score
6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Last updated on July 22nd, 2025

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Palo Alto Networks - Defect ID: PAN-145133

A fix was made to address a vulnerability in the PAN-OS signature-based threat detection engine that allowed an attacker to evade threat prevention signatures using specifically crafted TCP packets ( CVE-2020-1999 ).

Last updated on July 22nd, 2025

BugZero Risk Score6.3 Medium

Bug Details

Disclaimer

Links

Top Palo Alto Networks Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
6.3 Medium

BugZero Risk Score
6.3 Medium