{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-3386"
      ],
      "details": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.",
      "id": "GSD-2024-3386",
      "modified": "2024-04-11T05:03:27.242248Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@paloaltonetworks.com",
        "ID": "CVE-2024-3386",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "PAN-OS",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "changes": [
                                  {
                                    "at": "9.0.17-h2",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "9.0.17-h2",
                                "status": "affected",
                                "version": "9.0.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "9.1.17",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "9.1.17",
                                "status": "affected",
                                "version": "9.1.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "10.0.13",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "10.0.13",
                                "status": "affected",
                                "version": "10.0.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "10.1.9-h3",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "10.1.9-h3",
                                "status": "affected",
                                "version": "10.1.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "10.1.10",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "10.1.10",
                                "status": "affected",
                                "version": "10.1.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "10.2.4-h2",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "10.2.4-h2",
                                "status": "affected",
                                "version": "10.2.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "10.2.5",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "10.2.5",
                                "status": "affected",
                                "version": "10.2.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "11.0.1-h2",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "11.0.1-h2",
                                "status": "affected",
                                "version": "11.0.0",
                                "versionType": "custom"
                              },
                              {
                                "changes": [
                                  {
                                    "at": "11.0.2",
                                    "status": "unaffected"
                                  }
                                ],
                                "lessThan": "11.0.2",
                                "status": "affected",
                                "version": "11.0.0",
                                "versionType": "custom"
                              },
                              {
                                "status": "unaffected",
                                "version": "11.1.0"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Cloud NGFW",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "status": "unaffected",
                                "version": "All"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Prisma Access",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "unaffected",
                            "versions": [
                              {
                                "status": "unaffected",
                                "version": "All"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Palo Alto Networks"
            }
          ]
        }
      },
      "configuration": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device \u003e Certificate Management \u003e SSL Decryption Exclusions)."
            }
          ],
          "value": "You must configure Predefined Decryption Exclusions on your PAN-OS firewalls. You should check to see whether you have any configured exclusions in your firewall web interface (Device \u003e Certificate Management \u003e SSL Decryption Exclusions)."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks thanks Frederic De Vlieger for discovering and reporting this issue."
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption."
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u003cbr\u003e"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"
        }
      ],
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-436",
                "lang": "eng",
                "value": "CWE-436 Interpretation Conflict"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://security.paloaltonetworks.com/CVE-2024-3386",
            "refsource": "MISC",
            "url": "https://security.paloaltonetworks.com/CVE-2024-3386"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.\u003cbr\u003e"
            }
          ],
          "value": "This issue is fixed in 9.0.17-h2, 9.0.18, 9.1.17, 10.0.13, 10.1.9-h3, 10.1.10, 10.2.4-h2, 10.2.5, 11.0.1-h2, 11.0.2, 11.1.0 and all later PAN-OS versions.\n"
        }
      ],
      "source": {
        "defect": [
          "PAN-208155"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption."
          }
        ],
        "id": "CVE-2024-3386",
        "lastModified": "2024-04-10T19:49:51.183",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "psirt@paloaltonetworks.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-10T17:15:57.593",
        "references": [
          {
            "source": "psirt@paloaltonetworks.com",
            "url": "https://security.paloaltonetworks.com/CVE-2024-3386"
          }
        ],
        "sourceIdentifier": "psirt@paloaltonetworks.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-436"
              }
            ],
            "source": "psirt@paloaltonetworks.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}