Question about SVD-2023-0805

[intgmt]

I have a question about security advisory SVD-2023-0805. It states only Splunk Web is affected, but the description clearly mentions the issue is caused by how OpenSSL is built, which is a very generic library. For this reason I would like to check if indeed only Splunk Web is affected, or that Splunk installations on Windows in general are affected.

I can imagine that OpenSSL is also used when a SSL/TLS connection is made from a forwarder to an indexer. This leads to the question: are universal forwarders on Windows also affected by this security advisory, even when Splunk Web is disabled?

[richgalloway]

I don't understand it, either, but Splunk engineering has confirmed only Splunk Web is affected.  That would exclude all Universal Forwarders.