June Third Party Package Updates in Splunk Enterprise
Advisory ID: SVD-2023-0613
CVE ID: Multiple
Published: 2023-06-01
Last Update: 2023-06-01
Description
Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in versions 8.1.14, 8.2.11, and 9.0.5 of Splunk Enterprise, including the following:
| Package | Remediation | Severity |
|---|---|---|
| libxml2 | Patched | CVE-2022-40303 |
| libxml2 | Patched | CVE-2022-40304 |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2023-0286 |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2023-0215 |
| OpenSSL 1.0.2 | Upgraded to 1.0.2zg | CVE-2022-4304 |
| curl | Upgraded to 8.0.1 | CVE-2023-27538 |
| curl | Upgraded to 8.0.1 | CVE-2023-27537 |
| curl | Upgraded to 8.0.1 | CVE-2023-27536 |
| curl | Upgraded to 8.0.1 | CVE-2023-27535 |
| curl | Upgraded to 8.0.1 | CVE-2023-27534 |
| curl | Upgraded to 8.0.1 | CVE-2023-27533 |
| curl | Upgraded to 8.0.1 | CVE-2023-23916 |
| curl | Upgraded to 8.0.1 | CVE-2023-23915 |
| curl | Upgraded to 8.0.1 | CVE-2023-23914 |
| curl | Upgraded to 8.0.1 | CVE-2022-43552 |
| curl | Upgraded to 8.0.1 | CVE-2022-43551 |
| curl | Upgraded to 8.0.1 | CVE-2022-42916 |
| curl | Upgraded to 8.0.1 | CVE-2022-42915 |
| curl | Upgraded to 8.0.1 | CVE-2022-35260 |
| curl | Upgraded to 8.0.1 | CVE-2022-32221 |
| curl | Upgraded to 8.0.1 | CVE-2022-35252 |
| curl | Upgraded to 8.0.1 | CVE-2022-32208 |
| curl | Upgraded to 8.0.1 | CVE-2022-32207 |
| curl | Upgraded to 8.0.1 | CVE-2022-32206 |
| curl | Upgraded to 8.0.1 | CVE-2022-32205 |
| curl | Upgraded to 8.0.1 | CVE-2022-30115 |
| curl | Upgraded to 8.0.1 | CVE-2022-27782 |
| curl | Upgraded to 8.0.1 | CVE-2022-27781 |
| curl | Upgraded to 8.0.1 | CVE-2022-27780 |
| curl | Upgraded to 8.0.1 | CVE-2022-27779 |
| curl | Upgraded to 8.0.1 | CVE-2022-27778 |
| curl | Upgraded to 8.0.1 | CVE-2022-27776 |
| curl | Upgraded to 8.0.1 | CVE-2022-27775 |
| curl | Upgraded to 8.0.1 | CVE-2022-27774 |
| curl | Upgraded to 8.0.1 | CVE-2022-22576 |
| curl | Upgraded to 8.0.1 | CVE-2021-22947 |
| curl | Upgraded to 8.0.1 | CVE-2021-22946 |
| curl | Upgraded to 8.0.1 | CVE-2021-22945 |
| curl | Upgraded to 8.0.1 | CVE-2021-22926 |
| curl | Upgraded to 8.0.1 | CVE-2021-22925 |
| curl | Upgraded to 8.0.1 | CVE-2021-22924 |
| curl | Upgraded to 8.0.1 | CVE-2021-22923 |
| curl | Upgraded to 8.0.1 | CVE-2021-22922 |
| curl | Upgraded to 8.0.1 | CVE-2021-22901 |
| curl | Upgraded to 8.0.1 | CVE-2021-22898 |
| curl | Upgraded to 8.0.1 | CVE-2021-22897 |
| curl | Upgraded to 8.0.1 | CVE-2021-22890 |
| curl | Upgraded to 8.0.1 | CVE-2021-22876 |
| curl | Upgraded to 8.0.1 | CVE-2020-8286 |
| curl | Upgraded to 8.0.1 | CVE-2020-8285 |
| curl | Upgraded to 8.0.1 | CVE-2020-8284 |
| curl | Upgraded to 8.0.1 | CVE-2020-8231 |
| curl | Upgraded to 8.0.1 | CVE-2020-8177 |
| curl | Upgraded to 8.0.1 | CVE-2020-8169 |
| libarchive | Upgraded to 3.6.2 | CVE-2022-36227 |
| libarchive | Upgraded to 3.6.2 | CVE-2021-31566 |
| libarchive | Upgraded to 3.6.2 | CVE-2021-36976 |
| lz4 | Upgraded to 1.9.4 | CVE-2021-3520 |
| SQLite | Upgraded to 3.41.2 | CVE-2022-35737 |
| zlib | Applied patch | CVE-2018-25032 |
| zlib | Applied patch | CVE-2022-37434 |
| prismjs | Upgraded to 1.2.9 | CVE-2020-15138 |
| xmldom | Upgraded to 0.7.9 | CVE-2022-37616 |
| certifi | Upgraded to 2022.12.7 | CVE-2022-23491 |
| color-string | Upgraded to 1.5.5 | CVE-2021-29060 |
| decode-uri-component | Upgraded to 0.2.1 | CVE-2022-38900 |
| glob-parent | Upgraded to 5.1.2 | CVE-2020-28469 |
| json5 | Upgraded to 1.0.2 | CVE-2022-46175 |
| json5 | Upgraded to 2.2.3 | CVE-2022-46175 |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37599 |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37601 |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37603 |
| minimatch | Upgraded to 3.0.5 | CVE-2022-3517 |
| moment | Upgraded to 2.29.4 | CVE-2022-31129 |
| path-parse | Upgraded to 1.0.7 | CVE-2021-23343 |
| postcss | Upgraded to 7.0.36 | CVE-2021-23368 |
| postcss | Upgraded to 7.0.36 | CVE-2021-23382 |
| python3 | Upgraded to 3.7.16 | CVE-2022-43680 |
| qs | Upgraded to 6.5.3 | CVE-2022-24999 |
| ssri | Uppgraded to 6.0.2 | CVE-2020-7753 |
| terser | Upgraded to 4.8.1 | CVE-2022-25858 |
| nth-check | Upgraded to 2.0.1 | CVE-2021-3803 |
| trim | Upgraded to 0.0.3 | CVE-2020-7753 |
| css-what | Upgraded to 5.0.1 | CVE-2021-33587 |
| dot-prop | Upgraded to 4.2.1 | CVE-2020-8116 |
| elliptic | Upgraded to 6.5.4 | CVE-2020-13822 |
| got | Upgraded to 12.5.3 | CVE-2022-33987 |
| jackson-databind | Upgraded to 2.13.5 | CVE-2022-4200 |
| jackson-databind | Upgraded to 2.13.5 | CVE-2022-42004 |
| json-smart | Upgraded to 2.4.9 | CVE-2023-1370 |
| kind-of | Upgraded to 6.0.3 | CVE-2019-20149 |
| loader-utils | Upgraded to 1.4.2 | CVE-2022-37601 |
| loader-utils | Upgraded to 2.0.4 | CVE-2022-37601 |
| lodash | Upgraded to 4.17.21 | CVE-2020-8203 |
| lodash-es | Upgraded to 4.17.21 | CVE-2019-10744 |
| mako | Upgraded to 1.2.4 | CVE-2022-40023 |
| mixin-deep | Upgraded to 1.3.2 | CVE-2019-10746 |
| postcss | Upgraded to 7.0.37 | CVE-2021-23382 |
| normalize-url | Upgraded to 6.1.0 | CVE-2021-33502 |
| ua-parser-js | Upgraded to 0.7.35 | CVE-2021-27292 |
| urllib3 | Upgraded to 1.26.6 | CVE-2021-33503 |
| websocket-extensions | Upgraded to 0.1.4 | CVE-2020-7662 |
| y18n | Upgraded to 4.0.3 | CVE-2020-7774 |
| go, crypto/elliptic | Upgraded go to 1.2 | CVE-2022-23806 |
| go, math/big | Upgraded go to 1.2 | CVE-2022-23772 |
| go, x/crypto | Upgraded go to 1.2 | CVE-2021-43565 |
| go, os/exec | Upgraded go to 1.2 | CVE-2022-30580 |
| go, encoding/xml | Upgraded go to 1.2 | CVE-2022-30633 |
| go, encoding/xml | Upgraded go to 1.2 | CVE-2022-28131 |
| go, path/filepath | Upgraded go to 1.2 | CVE-2022-30632 |
| go | Upgraded go to 1.2 | CVE-2022-41716 |
| go, crypto/elliptic | Upgraded go to 1.2 | CVE-2022-28327 |
| go | Upgraded go to 1.2 | CVE-2022-24921 |
| go, io/fs | Upgraded go to 1.2 | CVE-2022-30630 |
| go, crypto/ssh | Upgraded go to 1.2 | CVE-2022-27191 |
| go, cmd/go | Upgraded go to 1.2 | CVE-2022-23773 |
| go, crypto/rand | Upgraded go to 1.2 | CVE-2022-30634 |
| go | Upgraded go to 1.2 | CVE-2022-41715 |
| go, encoding/pem | Upgraded go to 1.2 | CVE-2022-24675 |
| go | Upgraded go to 1.2 | CVE-2022-41720 |
| go, net/http | Upgraded go to 1.2 | CVE-2022-27664 |
| go, net/http | Upgraded go to 1.2 | CVE-2022-2880 |
| go, path/filepath | Upgraded go to 1.2 | CVE-2022-29804 |
| go, math/big | Upgraded go to 1.2 | CVE-2022-32189 |
| go, encoding/gob | Upgraded go to 1.2 | CVE-2022-30635 |
| go, compress/gzip | Upgraded go to 1.2 | CVE-2022-30631 |
| go | Upgraded go to 1.2 | CVE-2022-2879 |
| go, net/http | Upgraded go to 1.2 | CVE-2022-1705 |
| go, go/parse | Upgraded go to 1.2 | CVE-2022-1962 |
| go, sys | Upgraded go to 1.2 | CVE-2022-29526 |
| go, net/http | Upgraded go to 1.2 | CVE-2022-32148 |
| go, crypto/tls | Upgraded go to 1.2 | CVE-2022-30629 |
| Growl | Upgraded to 1.10.5 | CVE-2017-16042 |
| Babel | Upgraded to 2.9.1 | CVE-2021-20095 |
Solution
For Splunk Enterprise, upgrade versions to 8.1.14, 8.2.11, 9.0.5, or higher.
Product Status
| Product | Version | Component | Affected Version | Fix Version |
|---|---|---|---|---|
| Splunk Enterprise | 8.1 | - | 8.1.13 and Lower | 8.1.14 |
| Splunk Enterprise | 8.2 | - | 8.2.0 to 8.2.10 | 8.2.11 |
| Splunk Enterprise | 9.0 | - | 9.0.0 to 9.0.4 | 9.0.5 |
Severity
For the CVEs listed above, Splunk adopted the national vulnerability database (NVD) CVSS rating to align with industry standards.