topic Re: OpenSSL installed is prior to 1.0.2zf in Security

OpenSSL installed is prior to 1.0.2zf

giangi181128 — Thu, 25 Jan 2024 15:27:51 GMT

I have this vulnerability on all our instances on the last version of splunkforwarder

The version of OpenSSL installed on the remote host is prior to 1.0.2zf. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zf advisory.
identified in CVE-2022-1292,
the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

Any recommendation here

Re: OpenSSL installed is prior to 1.0.2zf

isoutamo — Fri, 26 Jan 2024 10:22:10 GMT

You should check from https://advisory.splunk.com/?301=/en_us/product-security.html in which version Splunk has fixed this. Then update your environment at least to that version or even better if you could go to the latest one.

You could check which openssl version you have. in splunk by

splunk version Splunk 9.1.2 (build b6b9c8185839) splunk cmd openssl version OpenSSL 1.0.2zi 1 Aug 2023

This works both Splunk server and UF.

r. Ismo

Re: OpenSSL installed is prior to 1.0.2zf

PickleRick — Fri, 26 Jan 2024 12:42:57 GMT

The recommendation would be to get a decent security team. This "finding" is completely false.

Firstly, the current openssl version for UF 9.1 is at least 1.0.2zg-fips.

Secondly, UF doesn't contain the c_rehash script so even with the "vulnerable" version the UF as a whole was not vulnerable.

Sending out "findings" based just on recognized versions of software is really a very low-effort vulnerability "management".