August Third Party Package Updates in Splunk Universal Forwarder

Advisory ID: SVD-2023-0809

CVE ID:  Multiple

Published: 2023-08-30

Last Update: 2023-08-30

Description

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder, including the folLowing:

CVEPackageRemediationSeverity
CVE-2021-30560libxsltPatchedHigh
CVE-2021-30560libxsltPatchedHigh
CVE-2023-27538curlUpgraded to 8.0.1Medium
CVE-2023-27537curlUpgraded to 8.0.1Medium
CVE-2023-27536curlUpgraded to 8.0.1Medium
CVE-2023-27535curlUpgraded to 8.0.1Medium
CVE-2023-27534curlUpgraded to 8.0.1High
CVE-2023-27533curlUpgraded to 8.0.1High
CVE-2023-23916curlUpgraded to 8.0.1Medium
CVE-2023-23915curlUpgraded to 8.0.1Medium
CVE-2023-23914curlUpgraded to 8.0.1Critical
CVE-2022-43552curlUpgraded to 8.0.1Medium
CVE-2022-43551curlUpgraded to 8.0.1High
CVE-2022-42916curlUpgraded to 8.0.1High
CVE-2022-42915curlUpgraded to 8.0.1High
CVE-2022-35260curlUpgraded to 8.0.1Medium
CVE-2022-32221curlUpgraded to 8.0.1Critical
CVE-2022-35252curlUpgraded to 8.0.1Low
CVE-2022-32208curlUpgraded to 8.0.1Medium
CVE-2022-32207curlUpgraded to 8.0.1Critical
CVE-2022-32206curlUpgraded to 8.0.1Medium
CVE-2022-32205curlUpgraded to 8.0.1Medium
CVE-2022-30115curlUpgraded to 8.0.1Medium
CVE-2022-27782curlUpgraded to 8.0.1High
CVE-2022-27781curlUpgraded to 8.0.1High
CVE-2022-27780curlUpgraded to 8.0.1High
CVE-2022-27779curlUpgraded to 8.0.1Medium
CVE-2022-27778curlUpgraded to 8.0.1High
CVE-2022-27776curlUpgraded to 8.0.1Medium
CVE-2022-27775curlUpgraded to 8.0.1High
CVE-2022-27774curlUpgraded to 8.0.1Medium
CVE-2022-22576curlUpgraded to 8.0.1High
CVE-2021-22947curlUpgraded to 8.0.1Medium
CVE-2021-22946curlUpgraded to 8.0.1High
CVE-2021-22945curlUpgraded to 8.0.1Critical
CVE-2021-22926curlUpgraded to 8.0.1High
CVE-2021-22925curlUpgraded to 8.0.1Medium
CVE-2021-22924curlUpgraded to 8.0.1Low
CVE-2021-22923curlUpgraded to 8.0.1Medium
CVE-2021-22922curlUpgraded to 8.0.1Medium
CVE-2021-22901curlUpgraded to 8.0.1High
CVE-2021-22898curlUpgraded to 8.0.1Low
CVE-2021-22897curlUpgraded to 8.0.1Medium
CVE-2021-22890curlUpgraded to 8.0.1Low
CVE-2021-22876curlUpgraded to 8.0.1Medium
CVE-2020-8286curlUpgraded to 8.0.1High
CVE-2020-8285curlUpgraded to 8.0.1High
CVE-2020-8284curlUpgraded to 8.0.1Low
CVE-2020-8231curlUpgraded to 8.0.1High
CVE-2020-8177curlUpgraded to 8.0.1High
CVE-2020-8169curlUpgraded to 8.0.1High
CVE-2022-36227libarchiveUpgraded to 3.6.2Critical
CVE-2021-31566libarchiveUpgraded to 3.6.2High
CVE-2021-36976libarchiveUpgraded to 3.6.2Medium
CVE-2021-3520lz4Upgraded to. 1.9.4Critical
CVE-2020-14155pcre2Upgraded to 10.40Medium
CVE-2019-20454pcre2Upgraded to 10.40High
CVE-2019-20838pcre2Upgraded to 10.40High
CVE-2020-14155pcre2Upgraded to 10.40Medium
CVE-2019-20454pcre2Upgraded to 10.40High
CVE-2019-20838pcre2Upgraded to 10.40High
CVE-2022-35737sqliteUpgraded to 3.41.2High

Solution

For Splunk Universal Forwarder, upgrade versions to 8.2.12, 9.0.6, or 9.1.1.

Product Status

ProductVersionComponentAffected VersionFix Version
Universal Forwarder8.2-8.2.0 to 8.2.118.2.12
Universal Forwarder9.0-9.0.0 to 9.0.59.0.6
Universal Forwarder9.1-9.1.09.1.1

Severity

For the CVEs in this list, Splunk adopted the national vulnerability database (NVD) common vulnerability scoring system (CVSS) rating to align with industry standards.