PT-2021-8043 · Splunk · Splunk Enterprise

Joshua-Triplett-Mandiant · Published 2021-07-06 · Updated 2025-03-27 · CVE-2021-32559

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pywin32 versions prior to b301

Description An integer overflow exists when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. This could allow a remote attacker to crash the vulnerable process. The issue is related to the pywin32 package used in the Splunk Enterprise platform for operational analysis.

Recommendations For versions prior to b301, update to version b301 or later to resolve the issue. As a temporary workaround, consider restricting the size of access control lists to prevent the integer overflow.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2024-04290

CVE-2021-32559

GHSA-HWFP-HG2M-9VR2

PYSEC-2021-112

Affected Products

Splunk Enterprise

References · 18

• https://github.com/mhammond/pywin32/issues/1700 · Patch
• https://bdu.fstec.ru/vul/2024-04290 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32559 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwfp-hg2m-9vr2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32559 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-112 · Vendor Advisory
• https://github.com/mhammond/pywin32/releases · Note
• https://github.com/mhammond/pywin32/pull/1701 · Note
• https://github.com/mhammond/pywin32 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pywin32/PYSEC-2021-112.yaml · Note
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.md · Note
• https://t.me/cvenotify/17126 · Telegram Post
• https://github.com/advisories/GHSA-hwfp-hg2m-9vr2 · Note
• https://cybersecurity-help.cz/vdb/SB2021071207 · Note
• https://t.me/cvenotify/20827 · Telegram Post