Splunk Enterprise Addresses Vulnerabilities in Bundled Third-Party Packages
Splunk has released critical security updates for its Enterprise platform, addressing multiple vulnerabilities in bundled third-party packages across several product versions.
The company issued Advisory SVD-2025-0710 on July 7, 2025, urging immediate updates to protect against various security exposures ranging from informational to critical severity levels.
Critical Security Updates Released
Splunk Enterprise versions 9.4.3, 9.3.5, 9.2.7, and 9.1.10 have been released to remediate numerous Common Vulnerabilities and Exposures (CVEs) found in third-party packages.
The updates address vulnerabilities in essential components including setuptools, golang cryptographic libraries, networking packages, and various system utilities that could potentially compromise system security.
The most significant vulnerability addressed is CVE-2024-45337 in the golang.org/x/crypto package used by spl2-orchestrator, which carries a critical severity rating.
This vulnerability, along with multiple high-severity issues in golang components, posed substantial risks to enterprise deployments running affected versions.
The security update encompasses improvements to several critical components. The setuptools package has been upgraded to version 70.0.0 to address CVE-2024-6345, a high-severity vulnerability affecting Python 3.9 packages.
Multiple golang cryptographic and networking libraries have received substantial updates, with crypto packages upgraded to versions 0.36.0 and 0.37.0, and networking components updated to versions 0.37.0 and 0.39.0.
| CVE ID | Component | Severity | Package |
| CVE-2024-6345 | setuptools | High | setuptools 70.0.0 |
| CVE-2025-22869 | golang crypto | High | Multiple golang components |
| CVE-2024-45337 | golang crypto | Critical | spl2-orchestrator |
| CVE-2024-45338 | golang net | Medium | Multiple golang components |
| CVE-2013-7489 | Beaker | Medium | Beaker 1.12.1 |
| CVE-2022-30187 | azure-storage-blob | Medium | azure-storage-blob 12.13.0 |
| CVE-2024-13176 | OpenSSL | Low | OpenSSL 1.0.2zl |
| CVE-2024-9143 | OpenSSL | Informational | OpenSSL 1.0.2zl |
| CVE-2025-27414 | golang | High | Multiple golang components |
| CVE-2025-22868 | golang | High | Multiple golang components |
| CVE-2025-23387 | golang | High | Multiple golang components |
| CVE-2025-23389 | golang | High | Multiple golang components |
| CVE-2025-23388 | golang | High | Multiple golang components |
| CVE-2025-22952 | golang | High | Multiple golang components |
| CVE-2025-22870 | golang | High | Mongodump/Mongorestore |
| CVE-2024-0853 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-2398 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-2466 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-7264 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-8096 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-9681 | libcurl | High | libcurl 8.11.1 |
| CVE-2024-11053 | libcurl | High | libcurl 8.11.1 |
| CVE-2025-0167 | libcurl | High | libcurl 8.11.1 |
| CVE-2025-0725 | libcurl | High | libcurl 8.11.1 |
Organizations running affected Splunk Enterprise versions should prioritize updating to the latest fixed versions immediately.
The presence of critical and high-severity vulnerabilities, particularly in cryptographic and networking components, makes these updates essential for maintaining security posture and protecting sensitive data processing capabilities.
Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.
Source link
