OpenSSL installed is prior to 1.0.2zf

[giangi181128]

I have this vulnerability on all our instances on the last version of splunkforwarder

The version of OpenSSL installed on the remote host is prior to 1.0.2zf. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zf advisory.
identified in CVE-2022-1292,
the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

Any recommendation here

[PickleRick]

The recommendation would be to get a decent security team. This "finding" is completely false.

Firstly, the current openssl version for UF 9.1 is at least 1.0.2zg-fips.

Secondly, UF doesn't contain the c_rehash script so even with the "vulnerable" version the UF as a whole was not vulnerable.

Sending out "findings" based just on recognized versions of software is really a very low-effort vulnerability "management".

[isoutamo]

Hi

You should check from https://advisory.splunk.com/?301=/en_us/product-security.html in which version Splunk has fixed this. Then update your environment at least to that version or even better if you could go to the latest one.

You could check which openssl version you have. in splunk by

splunk version
Splunk 9.1.2 (build b6b9c8185839)

splunk cmd openssl version
OpenSSL 1.0.2zi  1 Aug 2023

This works both Splunk server and UF.

r. Ismo