Splunk Enterprise Addresses Vulnerabilities in Bundled Third-Party Packages – Update Now

Splunk has released critical security updates for its Enterprise platform, addressing multiple vulnerabilities in bundled third-party packages across several product versions. The company issued Advisory SVD-2025-0710 on July 7, 2025, urging immediate updates to protect against various security exposures ranging from informational to critical severity levels. Critical Security Updates Released Splunk Enterprise versions 9.4.3, 9.3.5, 9.2.7, and 9.1.10 have been released to remediate numerous Common Vulnerabilities and Exposures (CVEs) found in third-party packages. The updates address vulnerabilities in essential components including setuptools, golang cryptographic libraries, networking packages, and various system utilities that could potentially compromise system security. The most significant vulnerability addressed is CVE-2024-45337 in the golang.org/x/crypto package used by spl2-orchestrator, which carries a critical severity rating. This vulnerability, along with multiple high-severity issues in golang components, posed substantial risks to enterprise deployments running affected versions. The security update encompasses improvements to several critical components. The setuptools package has been upgraded to version 70.0.0 to address CVE-2024-6345, a high-severity vulnerability affecting Python 3.9 packages. Multiple golang cryptographic and networking libraries have received substantial updates, with crypto packages upgraded to versions 0.36.0 and 0.37.0, and networking components updated to versions 0.37.0 and 0.39.0. CVE IDComponentSeverityPackageCVE-2024-6345setuptoolsHighsetuptools 70.0.0CVE-2025-22869golang cryptoHighMultiple golang componentsCVE-2024-45337golang cryptoCriticalspl2-orchestratorCVE-2024-45338golang netMediumMultiple golang componentsCVE-2013-7489BeakerMediumBeaker 1.12.1CVE-2022-30187azure-storage-blobMediumazure-storage-blob 12.13.0CVE-2024-13176OpenSSLLowOpenSSL 1.0.2zlCVE-2024-9143OpenSSLInformationalOpenSSL 1.0.2zlCVE-2025-27414golangHighMultiple golang componentsCVE-2025-22868golangHighMultiple golang componentsCVE-2025-23387golangHighMultiple golang componentsCVE-2025-23389golangHighMultiple golang componentsCVE-2025-23388golangHighMultiple golang componentsCVE-2025-22952golangHighMultiple golang componentsCVE-2025-22870golangHighMongodump/MongorestoreCVE-2024-0853libcurlHighlibcurl 8.11.1CVE-2024-2398libcurlHighlibcurl 8.11.1CVE-2024-2466libcurlHighlibcurl 8.11.1CVE-2024-7264libcurlHighlibcurl 8.11.1CVE-2024-8096libcurlHighlibcurl 8.11.1CVE-2024-9681libcurlHighlibcurl 8.11.1CVE-2024-11053libcurlHighlibcurl 8.11.1CVE-2025-0167libcurlHighlibcurl 8.11.1CVE-2025-0725libcurlHighlibcurl 8.11.1 Organizations running affected Splunk Enterprise versions should prioritize updating to the latest fixed versions immediately. The presence of critical and high-severity vulnerabilities, particularly in cryptographic and networking components, makes these updates essential for maintaining security posture and protecting sensitive data processing capabilities. Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.

Based on reporting by GBHackers.