OpenSSL SEoL (1.1.1.x)

benedicteflora — Thu, 29 Aug 2024 22:54:57 GMT

Our vulnerability scan is reporting a critical severity finding affecting several components of Splunk Enterprise related to OpenSSL (1.1.1.x) version that has become EOL/EOS. My researches seem to point out that this version of OpenSSL may not yet be EOS for Splunk due to a purchase of an extended support contract; however, I have been unsuccessful in finding a documentation to support this. Please help provide this information or suggest how this finding can be addressed.

Path : /opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/libcrypto.so
Installed version : 1.1.1k
Security End of Life : September 11, 2023
Time since Security End of Life (Est.) : >= 6 months

Thank you.

Re: OpenSSL SEoL (1.1.1.x)

richgalloway — Fri, 30 Aug 2024 13:30:39 GMT

What version of the app are you using? Does the vulnerability tool report a CVE? What is it?

topic Re: OpenSSL SEoL (1.1.1.x) in Splunk Enterprise

OpenSSL SEoL (1.1.1.x)

Re: OpenSSL SEoL (1.1.1.x)