Ok, that's what was missing! So I deduced it from the following information: From OpenSSL.Org: **** OpenSSL 1.0.2 is out of support since 1st January 2020 and is no longer receiving updates. Extended support is available from OpenSSL Software Services for premium support customers. CVE-2024-0727 - Fixed in OpenSSL 1.0.2zj (premium support) (Affected since 1.0.2) **** Since only premium customers get 1.0.2.zj, and Splunk has it, they are therefore a Premium customer. ... View more

As I said, go to openssl.org. The information is there.   ... View more

I found an answer for this. If you check out openssl.org, the version is not actually EOL for PREMIUM customers, which Splunk is. An annotation in the findings checklist should suffice. Hope that helps. ... View more

Thanks. I am on Splunk Enterprise on a local server. Do you know where the file you reference is and its name? ... View more

Thanks for answering. What do you mean by " editing the lookup_edit file "? I am in  "Settings - User Interface - Views" but don't see any way to edit any file or where to alter the text you refer to. Where is this file I should edit? ... View more

In my case it is a DoD system and the openssl hits reference three nist concerns: CVE-2023-2975  CVE-2023-3446  CVE-2023-3817  I linked the nist articles, but apparently that isn't allowed. You can search them out if you want to. These are all considered medium vulnerabilities, except that under DoD the last one, authentication gets bumped up a notch because it is authentication related. OpenSSL has already addressed them. The question is when will Splunk integrate them into their own install packages. Going back to DoD and saying that it really isn't a big deal and I'm not going to fix it won't fly. The options are: get a vendor patch, get instructions from the vendor on how to patch it without an update, or update it without vendor support and hope you don't break anything. ... View more

No one has contacted me. I put in a support ticket today. I requested either an expected date for a newer version of OpenSSL to be added, or instructions on how to do it manually without compromising functionality or future upgrades. When I get an answer from them, I will post it. ... View more

A late follow up to this. Updating the certificate made no difference. I am using a third party certificate and it is current and valid. To "fix" it, I backed up my splunk configs, deleted the drive, reinstalled, and put the configs back again. Now it works. Something about the 8 to 9 upgrade just doesn't work. Reinstalling is easier than finding out what went wrong. Fortunately I only have to go through that once. The 9.x updates have not given me any further trouble. ... View more

If no one from Splunk chimes in with an expected patch date I will put in an official ticket. I would hope that a vulnerability listed as severe would have their full attention by now. ... View more

I am having the same issue, with kv store failing to initialize after upgrade from 8.25 to 9.03. I already copied the correct certificates back to etc/auth, and restarted splunkd, but same issue. Which conf file points Splunk to the correct certificate? Maybe it got replaced in the upgrade and I need to edit it? ... View more