June Third Party Package Updates in Splunk Enterprise
Advisory ID: SVD-2023-0613
CVE ID: Multiple
Published: 2023-06-01
Last Update: 2024-01-09
Description
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in versions 8.1.14, 8.2.11, and 9.0.5 of Splunk Enterprise, including the following:
| Package | Remediation | CVE | Severity |
|---|---|---|---|
| libxml2 | Patched | CVE-2022-40303 | High |
| libxml2 | Patched | CVE-2022-40304 | High |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2023-0286 | High |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2023-0215 | High |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2022-4304 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2023-27538 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2023-27537 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2023-27536 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2023-27535 | High |
| curl | Upgraded to 8.0.1 | CVE-2023-27534 | High |
| curl | Upgraded to 8.0.1 | CVE-2023-27533 | High |
| curl | Upgraded to 8.0.1 | CVE-2023-23916 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2023-23915 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2023-23914 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2022-43552 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-43551 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-42916 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-42915 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2022-35260 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-32221 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2022-35252 | Low |
| curl | Upgraded to 8.0.1 | CVE-2022-32208 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-32207 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2022-32206 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-32205 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-30115 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-27782 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-27781 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-27780 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-27779 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-27778 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-27776 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-27775 | High |
| curl | Upgraded to 8.0.1 | CVE-2022-27774 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2022-22576 | High |
| curl | Upgraded to 8.0.1 | CVE-2021-22947 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2021-22946 | High |
| curl | Upgraded to 8.0.1 | CVE-2021-22945 | Critical |
| curl | Upgraded to 8.0.1 | CVE-2021-22926 | High |
| curl | Upgraded to 8.0.1 | CVE-2021-22925 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2021-22924 | Low |
| curl | Upgraded to 8.0.1 | CVE-2021-22923 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2021-22922 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2021-22901 | High |
| curl | Upgraded to 8.0.1 | CVE-2021-22898 | Low |
| curl | Upgraded to 8.0.1 | CVE-2021-22897 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2021-22890 | Low |
| curl | Upgraded to 8.0.1 | CVE-2021-22876 | Medium |
| curl | Upgraded to 8.0.1 | CVE-2020-8286 | High |
| curl | Upgraded to 8.0.1 | CVE-2020-8285 | High |
| curl | Upgraded to 8.0.1 | CVE-2020-8284 | Low |
| curl | Upgraded to 8.0.1 | CVE-2020-8231 | High |
| curl | Upgraded to 8.0.1 | CVE-2020-8177 | High |
| curl | Upgraded to 8.0.1 | CVE-2020-8169 | High |
| libarchive | Upgraded to 3.6.2 | CVE-2022-36227 | Critical |
| libarchive | Upgraded to 3.6.2 | CVE-2021-31566 | High |
| libarchive | Upgraded to 3.6.2 | CVE-2021-36976 | Medium |
| lz4 | Upgraded to 1.9.4 | CVE-2021-3520 | Critical |
| SQLite | Upgraded to 3.41.2 | CVE-2022-35737 | High |
| zlib | Applied patch | CVE-2018-25032 | High |
| zlib | Applied patch | CVE-2022-37434 | Critical |
| prismjs | Upgraded to 1.2.9 | CVE-2020-15138 | High |
| xmldom | Upgraded to 0.7.9 | CVE-2022-37616 | Critical |
| color-string | Upgraded to 1.5.5 | CVE-2021-29060 | Medium |
| decode-uri-component | Upgraded to 0.2.1 | CVE-2022-38900 | High |
| glob-parent | Upgraded to 5.1.2 | CVE-2020-28469 | High |
| json5 | Upgraded to 1.0.2 | CVE-2022-46175 | High |
| json5 | Upgraded to 2.2.3 | CVE-2022-46175 | High |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37599 | High |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37601 | Critical |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37603 | High |
| minimatch | Upgraded to 3.0.5 | CVE-2022-3517 | High |
| moment | Upgraded to 2.29.4 | CVE-2022-31129 | High |
| path-parse | Upgraded to 1.0.7 | CVE-2021-23343 | High |
| postcss | Upgraded to 7.0.36 | CVE-2021-23368 | Medium |
| postcss | Upgraded to 7.0.36 | CVE-2021-23382 | High |
| python3 | Upgraded to 3.7.16 | CVE-2022-43680 | High |
| qs | Upgraded to 6.5.3 | CVE-2022-24999 | High |
| ssri | Uppgraded to 6.0.2 | CVE-2020-7753 | High |
| terser | Upgraded to 4.8.1 | CVE-2022-25858 | High |
| nth-check | Upgraded to 2.0.1 | CVE-2021-3803 | High |
| trim | Upgraded to 0.0.3 | CVE-2020-7753 | High |
| css-what | Upgraded to 5.0.1 | CVE-2021-33587 | High |
| dot-prop | Upgraded to 4.2.1 | CVE-2020-8116 | High |
| elliptic | Upgraded to 6.5.4 | CVE-2020-13822 | High |
| got | Upgraded to 12.5.3 | CVE-2022-33987 | Medium |
| jackson-databind | Upgraded to 2.13.5 | CVE-2022-4200 | Medium |
| jackson-databind | Upgraded to 2.13.5 | CVE-2022-42004 | High |
| json-smart | Upgraded to 2.4.9 | CVE-2023-1370 | High |
| kind-of | Upgraded to 6.0.3 | CVE-2019-20149 | High |
| loader-utils | Upgraded to 1.4.2 | CVE-2022-37601 | Critical |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37601 | Critical |
| lodash | Upgraded to 4.17.21 | CVE-2020-8203 | High |
| lodash-es | Upgraded to 4.17.21 | CVE-2019-10744 | Critical |
| mako | Patched* | CVE-2022-40023 | High |
| mako | Upgraded to 1.2.4** | CVE-2022-40023 | High |
| mixin-deep | Upgraded to 1.3.2 | CVE-2019-10746 | Critical |
| postcss | Upgraded to 7.0.37 | CVE-2021-23382 | High |
| normalize-url | Upgraded to 6.1.0 | CVE-2021-33502 | High |
| ua-parser-js | Upgraded to 0.7.35 | CVE-2021-27292 | High |
| urllib3 | Upgraded to 1.26.6 | CVE-2021-33503 | High |
| websocket-extensions | Upgraded to 0.1.4 | CVE-2020-7662 | High |
| y18n | Upgraded to 4.0.3 | CVE-2020-7774 | Critical |
| go, crypto/elliptic | Upgraded go to 1.2 | CVE-2022-23806 | Critical |
| go, math/big | Upgraded go to 1.2 | CVE-2022-23772 | High |
| go, x/crypto | Upgraded go to 1.2 | CVE-2021-43565 | High |
| go, os/exec | Upgraded go to 1.2 | CVE-2022-30580 | High |
| go, encoding/xml | Upgraded go to 1.2 | CVE-2022-30633 | High |
| go, encoding/xml | Upgraded go to 1.2 | CVE-2022-28131 | High |
| go, path/filepath | Upgraded go to 1.2 | CVE-2022-30632 | High |
| go | Upgraded go to 1.2 | CVE-2022-41716 | High |
| go, crypto/elliptic | Upgraded go to 1.2 | CVE-2022-28327 | High |
| go | Upgraded go to 1.2 | CVE-2022-24921 | High |
| go, io/fs | Upgraded go to 1.2 | CVE-2022-30630 | High |
| go, crypto/ssh | Upgraded go to 1.2 | CVE-2022-27191 | High |
| go, cmd/go | Upgraded go to 1.2 | CVE-2022-23773 | High |
| go, crypto/rand | Upgraded go to 1.2 | CVE-2022-30634 | High |
| go | Upgraded go to 1.2 | CVE-2022-41715 | High |
| go, encoding/pem | Upgraded go to 1.2 | CVE-2022-24675 | High |
| go | Upgraded go to 1.2 | CVE-2022-41720 | High |
| go, net/http | Upgraded go to 1.2 | CVE-2022-27664 | High |
| go, net/http | Upgraded go to 1.2 | CVE-2022-2880 | High |
| go, path/filepath | Upgraded go to 1.2 | CVE-2022-29804 | High |
| go, math/big | Upgraded go to 1.2 | CVE-2022-32189 | High |
| go, encoding/gob | Upgraded go to 1.2 | CVE-2022-30635 | High |
| go, compress/gzip | Upgraded go to 1.2 | CVE-2022-30631 | High |
| go | Upgraded go to 1.2 | CVE-2022-2879 | High |
| go, net/http | Upgraded go to 1.2 | CVE-2022-1705 | Medium |
| go, go/parse | Upgraded go to 1.2 | CVE-2022-1962 | Medium |
| go, sys | Upgraded go to 1.2 | CVE-2022-29526 | Medium |
| go, net/http | Upgraded go to 1.2 | CVE-2022-32148 | Medium |
| go, crypto/tls | Upgraded go to 1.2 | CVE-2022-30629 | Low |
| Growl | Upgraded to 1.10.5 | CVE-2017-16042 | Critical |
| Babel | Upgraded to 2.9.1 | CVE-2021-20095 | Medium |
*Splunk applied the patch for CVE-2022-40023 to mako 1.1.0 in $SPLUNK_HOME/lib/python3.7/site-packages/mako.
**Splunk upgraded mako to 1.2.4 in the Python Upgrade Readiness app to remediate CVE-2022-40023.
Solution
For Splunk Enterprise, upgrade versions to 8.1.14, 8.2.11, 9.0.5, or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk Enterprise | 8.1 | 8.1.13 and Lower | 8.1.14 |
| Splunk Enterprise | 8.2 | 8.2.0 to 8.2.10 | 8.2.11 |
| Splunk Enterprise | 9.0 | 9.0.0 to 9.0.4 | 9.0.5 |
Severity
For the CVEs listed above, Splunk adopted the national vulnerability database (NVD) CVSS rating to align with industry standards.
Changelog
2024-01-09: Updated and added clarification around CVE-2022-40023 remdiation in mako. Removed CVE-2022-23491.