First published: Tue Feb 14 2023(Updated: )
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) crashes the Splunk daemon (splunkd).
Credit: prodsec@splunk.com prodsec@splunk.com
Affected Software | Affected Version | How to fix |
---|---|---|
Splunk Splunk | >=8.1.0<8.1.13 | |
Splunk Splunk | >=8.2.0<8.2.10 | |
Splunk Splunk | >=9.0.0<9.0.4 | |
Splunk Splunk Cloud Platform | <9.0.2209.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Splunk Enterprise vulnerability is CVE-2023-22941.
CVE-2023-22941 has a severity of 7.5 (high).
Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4 are affected by CVE-2023-22941.
CVE-2023-22941 can crash the Splunk daemon (splunkd).
To fix CVE-2023-22941, update Splunk Enterprise to version 8.1.13, 8.2.10, or 9.0.4 or later.