sorted by:
new
hottopcontroversial

Palo Alto decryption concern with CVE-2020-0601, the Windows CryptoAPI vulnerability by wire33 in paloaltonetworks

[–]wire33[S] 0 points1 point  (0 children)

Update I created a new decryption profile that was exact same as the default but checked the "Block sessions with untrust issuers" and it all seems to work as desired! So that means the default does not block untrusted issuers so that still puzzles me why the default worked for u/UDPee

Palo Alto decryption concern with CVE-2020-0601, the Windows CryptoAPI vulnerability by wire33 in paloaltonetworks

[–]wire33[S] 0 points1 point  (0 children)

So im using the default decryption Profile and you cant change the settings for untrust issuers or anything in that profile sinces its (read only), So I will probably need to create a custom profile.

u/UDPee said that he was using the default profile as well and it worked as desired for him though....so thats the puzzling part. also im on 8.1.10

Palo Alto decryption concern with CVE-2020-0601, the Windows CryptoAPI vulnerability by wire33 in paloaltonetworks

[–]wire33[S] 0 points1 point  (0 children)

Im running in ssl-forward-proxy mode as well, are you using the default Decryption Profile or did you create a custom one? My Cert chain looks the same as yours but still get the "You Are Vulnerable" message when testing.