InfoSecBulletin Cybersecurity for mankind
Splunk has issued critical security updates for SOAR versions 6.4.0 and 6.4 to fix several vulnerabilities in third-party packages. The comprehensive security update published on July 7, 2025, fixes several Common Vulnerabilities and Exposures (CVEs) with severity levels from medium to critical.
Critical vulnerabilities impact core components like git, Django, cryptography libraries, and JavaScript packages, necessitating urgent action from security admins overseeing Splunk SOAR deployments.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Key Takeaways:
Splunk addresses multiple critical CVEs including CVE-2024-32002 (git) and CVE-2024-48949 (@babel/traverse) in SOAR versions 6.4.0 and 6.4.
Third-party components upgraded, including Django, cryptography, jQuery DataTables, and wkhtml removal, covering vulnerabilities from critical to medium severity
All SOAR 6.4 installations below version 6.4.1 must immediately upgrade to 6.4.1 orhigher
Unpatched vulnerabilities could enable unauthorized access, code execution, and data manipulation across the core SOAR infrastructure.
Critical Vulnerabilities Addressed:
The security advisory highlights critical vulnerabilities that pose immediate risks to SOAR environments. CVE-2024-32002 is a critical vulnerability in the git package found in Splunk SOAR versions 6.4.0 and 6.4.1. Upgrading to git version 2.48.1 resolves the issue.
The critical severity rating shows that this vulnerability is a serious security risk and needs prompt action from system administrators. CVE-2024-48949 represents another critical severity vulnerability, specifically targeting the @babel/traverse package.
In Splunk SOAR 6.4.0, the vulnerability was fixed by upgrading to version 7.26.7.
High-Severity Issues:
High-severity vulnerabilities include CVE-2024-45230 in Django, CVE-2024-21538 in cross-spawn, CVE-2024-52804 in tornado, CVE-2022-35583 wkhtml vulnerability, CVE-2024-6345 in Setuptools, CVE-2024-39338 in Axios JavaScript library and CVE-2024-49767 in Werkzeug WSGI utility library.
These vulnerabilities could potentially allow unauthorized access, code execution, or data manipulation within the SOAR environment.
Organizations must immediately upgrade to Splunk SOAR version 6.4.1 or higher to remediate all identified vulnerabilities.
The advisory affects all SOAR base version 6.4 installations below 6.4.1, making this update essential for maintaining security posture.
