Splunk Add-on for Amazon Web Services: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.5
  CVE-2024-39689 Public exploit

  Certifi removes GLOBALTRUST root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

  certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  Jul 5, 2024
• Medium 6.2
  CVE-2024-3651 Public exploit

  Denial of Service via Quadratic Complexity in kjd/idna

  A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

  kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 7, 2024
• Medium 4.4
  CVE-2024-37891

  Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

  urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

  urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 17, 2024
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023

Revision history

1. 2026-06-28 #6

   Neue Updates von SUSE aufgenommen

2. 2024-10-30 #5

   Neue Updates von Splunk-SVD aufgenommen

3. 2024-10-17 #4

   Neue Updates von Splunk-SVD aufgenommen

4. 2024-10-14 #3

   Neue Updates von Splunk-SVD aufgenommen

5. 2024-10-01 #2

   Produkt angepasst

6. 2024-09-30 #1

   Initiale Fassung

References

• Splunk Advisory vom 2024-09-30
  https://advisory.splunk.com/advisories/SVD-2024-0901
• Red Hat Advisory
  https://access.redhat.com/security/cve/CVE-2023-39326
• GitHub Advisory
  https://github.com/advisories/GHSA-jjg7-2v4v-x38h
• Red Hat Advisory
  https://access.redhat.com/security/cve/CVE-2024-37891
• GitHub Advisory
  https://github.com/advisories/GHSA-248v-346w-9cwc
• Splunk Security Advisory SVD-2024-1012 vom 2024-10-14
  https://advisory.splunk.com//advisories/SVD-2024-1012
• Splunk Security Advisory SVD-2024-1013 vom 2024-10-17
  https://advisory.splunk.com//advisories/SVD-2024-1013
• Splunk Security Advisory SVD-2024-1014 vom 2024-10-30
  https://advisory.splunk.com//advisories/SVD-2024-1014
• Splunk Security Advisory SVD-2024-1015 vom 2024-10-30
  https://advisory.splunk.com//advisories/SVD-2024-1015
• SUSE Security Update SUSE-SU-2026:2643-1 vom 2026-06-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027016.html