Third-Party Package Updates in Splunk Enterprise - July 2025

Advisory ID: SVD-2025-0710

CVE ID:  Multiple

Published: 2025-07-07

Last Update: 2025-07-07

Description

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, and higher, including the following:

PackageRemediationCVESeverity
setuptools1Upgraded to 70.0.0CVE-2024-6345High
golang.org/x/crypto2Upgraded golang crypto in compsup to 0.37.0MultipleHigh
golang.org/x/cryptoUpgraded golang crypto in identity to 0.36.0CVE-2025-22869High
golang.org/x/crypto3Upgraded golang crypto in spl2-orchestrator to 0.36.0CVE-2024-45337Critical
golang.org/x/net4Upgraded golang net in compsup to 0.39.0CVE-2024-45338Medium
golang.org/x/net5Upgraded golang net in spl2-orchestrator to 0.37.0CVE-2024-45338Medium
golang6Upgraded golang in Mongodump to 1.24.2MultipleHigh
golang7Upgraded golang in Mongorestore to 1.24.2MultipleHigh
golangUpgraded golang in spl2-orchestrator to 1.24.0MultipleHigh
Beaker8Upgraded to 1.12.1CVE-2013-7489Medium
azure-storage-blobUpgraded to 12.13.0CVE-2022-30187Medium
OpenSSLUpgraded to 1.0.2zlCVE-2024-13176Low
OpenSSL9Upgraded to 1.0.2zlCVE-2024-9143Informational
libcurl10Upgraded to 8.11.1MultipleHigh

1 Upgraded setuptools to version 70.0.0 for Python 3.9 packages located at /opt/splunk/lib/python3.9/site-packages/setuptools

2 Upgraded golang crypto in compsup to 0.37.0 to remedy CVE-2024-45337, CVE-2025-22869, CVE-2025-27414, CVE-2025-22868, CVE-2025-23387, CVE-2025-23389, CVE-2025-23388, CVE-2025-22952, CVE-2025-27414, and CVE-2024-45338 . The compsup binary is not in 9.1.x

3 The spl2-orchestrator binary is not in 9.3.x, 9.2.x, 9.1.x or older

4 The compsup binary is not in 9.1.x

5 The spl2-orchestrator binary is not in 9.3.x, 9.2.x, 9.1.x or older

6 Upgraded golang in Mongodump to 1.24.2 to remedy CVE-2025-22869, CVE-2025-27414, CVE-2025-22868, CVE-2025-23387, CVE-2025-23389, CVE-2025-23388, CVE-2025-22952, CVE-2025-27414, CVE-2024-45338, and CVE-2025-22870

7 Upgraded golang in Mongorestore to 1.24.2 to remedy CVE-2025-22869, CVE-2025-27414, CVE-2025-22868, CVE-2025-23387, CVE-2025-23389, CVE-2025-23388, CVE-2025-22952, CVE-2025-27414, CVE-2024-45338, and CVE-2025-22870

8 Upgraded Beaker Python package to 1.12.1 in 9.2.7 Splunk Enterprise

9 Splunk Enterprise’s and Universal Forwarder’s OpenSSL is not affected by CVE-2024-9143.

10 Upgraded libcurl to 8.11.1 to remedy CVE-2024-0853, CVE-2024-2398, CVE-2024-2466, CVE-2024-7264, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2025-0167, and CVE-2025-0725.

Solution

Upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher.

Product Status

ProductBase VersionAffected VersionFix Version
Splunk Enterprise9.49.4.0 to 9.4.29.4.3
Splunk Enterprise9.39.3.0 to 9.3.49.3.5
Splunk Enterprise9.29.2.0 to 9.2.69.2.7
Splunk Enterprise9.19.1.0 to 9.1.99.1.10

Severity

For the CVEs in this list, Splunk adopted the vendor’s severity rating or the National Vulnerability Database (NVD) common vulnerability scoring system (CVSS) rating, as available.