> set cli config-output-format set
> configure
# show | match 'http2 enable no'
| Version | Minor Version | Suggested Solution |
|---|---|---|
| PAN-OS 11.2 | 11.2.0 through 11.2.5 | Upgrade to 11.2.6 or later. |
| PAN-OS 11.1 | 11.1.0 through 11.1.7 | Upgrade to 11.1.8 or later. |
| PAN-OS 11.0 (EoL) | Upgrade to a supported fixed version. | |
| PAN-OS 10.2 | 10.2.0 through 10.2.14 | Upgrade to 10.2.15 or later. |
| PAN-OS 10.1 | 10.1.0 through 10.1.14-h11 | Upgrade to 10.1.14-h13 or later. |
| All other older unsupported PAN-OS versions | Upgrade to a supported fixed version. |
Using the Web Interface:
1. Select Monitor > Packet Capture > Captured Files > (Select All) and Delete the files.Using the PAN-OS CLI:
1. Enter the following operational command:> delete debug-filter file *
2. A confirmation prints to the terminal and indicates that all packet capture files were successfully deleted from the firewall:successfully removed *
" } ], "value": "This issue is fixed in PAN-OS 10.1.14-h13, PAN-OS 10.2.15, PAN-OS 11.1.8, PAN-OS 11.2.6, and all later PAN-OS versions.\n\nVersion\nMinor Version\nSuggested Solution\nPAN-OS 11.2\n11.2.0 through 11.2.5Upgrade to 11.2.6 or later.\nPAN-OS 11.111.1.0 through 11.1.7\nUpgrade to 11.1.8 or later.PAN-OS 11.0 (EoL)\n\nUpgrade to a supported fixed version.\nPAN-OS 10.2\n10.2.0 through 10.2.14\nUpgrade to 10.2.15 or later.\n\nPAN-OS 10.1\n10.1.0 through 10.1.14-h11\nUpgrade to 10.1.14-h13 or later.\nAll other older\nunsupported\nPAN-OS versions Upgrade to a supported fixed version.\nTo fully remediate risk, you must delete all pre-existing packet capture files stored on the firewall after you upgrade to a fixed PAN-OS version. This task can be performed through the PAN-OS web interface or through the PAN-OS CLI.Using the Web Interface:\n\n1. Select Monitor > Packet Capture > Captured Files > (Select All) and Delete the files.\n2. Select Yes when prompted by the confirmation dialog.Using the PAN-OS CLI:\n\n1. Enter the following operational command:\n> delete debug-filter file * \n\n2. A confirmation prints to the terminal and indicates that all packet capture files were successfully deleted from the firewall:\nsuccessfully removed *" } ], "source": { "defect": [ "PAN-257442" ], "discovery": "INTERNAL" }, "timeline": [ { "lang": "en", "time": "2025-04-09T16:00:00.000Z", "value": "Initial Publication" } ], "title": "PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Mitigation: In a Palo Alto Networks firewall, you can configure the decryption profile to strip ALPN (Application-Layer Protocol Negotiation) from the TLS handshake, which is used to negotiate the application protocol (e.g., HTTP/2 or HTTP/1.1) for the secured connection. When ALPN is absent, the following behaviors can occur: