CVE-2022-32158 - Can I just upgrade the deployment server to version 9.0 in a Splunk Cluster environment?

[mokabe]

Can I just upgrade the Splunk Enterprise deployment to version 9.0 in a Splunk Cluster environment?

[isoutamo]

Hi

If/when your DS has it's own server/node which are not doing anything else than DS function. And as LM must be the newest version in your environment you must update that 1st. And also same rules apply to it. It shouldn't be as a separate role in any other node like CM, SH, Deployer etc. If it is then you must separate that 1st before you really don't want to update your whole splunk infra to any new x.0.0 version!

After update you will gotten some warnings e.g. from MC (when using e.g. REST) that your peer should be at same level than MC. But don't update your MC to higher level than the rest of your splunk infra is!

r. Ismo

[VatsalJagani]

@mokabe - I think most of the questions answered here.

https://community.splunk.com/t5/Getting-Data-In/vulnerability-CVE-2022-32158-16-06-2022-versions-bef...

I hope this helps!!!

[PickleRick]

https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html

See the changelog - "Remediation only requires updating the Splunk Enterprise deployment servers to 9.0"

[mokabe]

Updating only the deployment server, can it cause any problems in the splunk cluster environment?

[PickleRick]

Deployment server is not used to manage cluster (either indexer cluster or search head cluster). It might be used to manage apps on cluster nodes indirectly (by pushing apps to master or deployer) but it's a very rare case and I do not even remember at the moment if both of those setups are supported.

So in general case deployment server only manages forwarders. It typically has nothing to do with cluster nodes.