PT-2022-21120 · Splunk · Splunk Cloud Platform+1

Chris Green · Published 2022-06-15 · Updated 2022-06-24 · CVE-2022-32151

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0 Splunk Cloud Platform versions prior to 8.2.2203

Description The issue concerns the httplib and urllib Python libraries in Splunk, which did not validate certificates using the certificate authority (CA) certificate stores by default. This has been addressed in newer versions where Python 3 client libraries now verify server certificates by default. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Splunk Enterprise versions prior to 9.0, update to Splunk Enterprise version 9.0. For Splunk Enterprise, configure TLS host name validation for Splunk-to-Splunk communications by following the documentation at https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation to enable the remediation. For Splunk Cloud Platform versions prior to 8.2.2203, update to version 8.2.2203 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-32151

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 6

• https://splunk.com/en_us/product-security/announcements/svd-2022-0601.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32151 · Security Note
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation · Vendor Advisory
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates · Vendor Advisory
• https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_simplerequest · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32151 · Vendor Advisory