Urgent Update: Splunk Patches Critical Vulnerabilities in Third-Party Packages. (March 2024) Here is what to know.

Serious security issues have been discovered in Splunk Enterprise, impacting versions below 9.2.1, 9.1.4, and 9.0.9. These vulnerabilities reside in third-party packages integrated with Splunk and could grant attackers unauthorized access to your systems.

The Scope of the Problem

The affected third-party packages include widely used libraries likeprotobuf, loader-utils, and others. These vulnerabilities range from high severity to critical, posing a significant risk to Splunk deployments.

The libraries in question, such as protobuf and loader-utils, are integral to many functionalities within Splunk. Protobuf, or Protocol Buffers, is used for serializing structured data, while loader-utils provides utility functions for loaders used in webpack, a module bundler.

What Attackers Could Do

Depending on the specific vulnerability exploited, attackers could potentially:

• Steal sensitive data stored within your Splunk environment.
• Take control of systems running Splunk, potentially disrupting critical operations.
• Gain a foothold in your network for further attacks.

Taking Action: Patch Immediately

Splunk has released security patches (versions 9.2.1, 9.1.4, and 9.0.9) that address these vulnerabilities. Upgrading to the latest version is critical to mitigate these risks.

Here’s what you need to do:

1. Identify your Splunk version: Check your Splunk instance to determine the current version you’re running.
2. Download the appropriate patch: Visit the Splunk download page (link in the Resources section) and download the patch that corresponds to your Splunk version.
3. Apply the patch: Follow Splunk’s official upgrade instructions to apply the patch to your Splunk environment.

It’s crucial to prioritize this update to safeguard your Splunk deployment and the sensitive data it stores.

Resources

• Splunk Security Advisories: https://advisory.splunk.com/
• Splunk Downloads: https://www.splunk.com/en_us/download.html

Stay Informed:

Subscribe to security advisories from Splunk to receive timely notifications about future vulnerabilities. By keeping your Splunk environment up to date, you can significantly enhance your security posture.

---

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it.