InfoSecBulletin Cybersecurity for mankind
Splunk has issued critical security updates for SOAR versions 6.4.0 and 6.4 to fix several vulnerabilities in third-party packages. The comprehensive security update published on July 7, 2025, fixes several Common Vulnerabilities and Exposures (CVEs) with severity levels from medium to critical.
Critical vulnerabilities impact core components like git, Django, cryptography libraries, and JavaScript packages, necessitating urgent action from security admins overseeing Splunk SOAR deployments.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Key Takeaways:
Splunk addresses multiple critical CVEs including CVE-2024-32002 (git) and CVE-2024-48949 (@babel/traverse) in SOAR versions 6.4.0 and 6.4.
Third-party components upgraded, including Django, cryptography, jQuery DataTables, and wkhtml removal, covering vulnerabilities from critical to medium severity
All SOAR 6.4 installations below version 6.4.1 must immediately upgrade to 6.4.1 orhigher
Unpatched vulnerabilities could enable unauthorized access, code execution, and data manipulation across the core SOAR infrastructure.
Critical Vulnerabilities Addressed:
The security advisory highlights critical vulnerabilities that pose immediate risks to SOAR environments. CVE-2024-32002 is a critical vulnerability in the git package found in Splunk SOAR versions 6.4.0 and 6.4.1. Upgrading to git version 2.48.1 resolves the issue.
The critical severity rating shows that this vulnerability is a serious security risk and needs prompt action from system administrators. CVE-2024-48949 represents another critical severity vulnerability, specifically targeting the @babel/traverse package.
In Splunk SOAR 6.4.0, the vulnerability was fixed by upgrading to version 7.26.7.
High-Severity Issues:
High-severity vulnerabilities include CVE-2024-45230 in Django, CVE-2024-21538 in cross-spawn, CVE-2024-52804 in tornado, CVE-2022-35583 wkhtml vulnerability, CVE-2024-6345 in Setuptools, CVE-2024-39338 in Axios JavaScript library and CVE-2024-49767 in Werkzeug WSGI utility library.
These vulnerabilities could potentially allow unauthorized access, code execution, or data manipulation within the SOAR environment.
Organizations must immediately upgrade to Splunk SOAR version 6.4.1 or higher to remediate all identified vulnerabilities.
The advisory affects all SOAR base version 6.4 installations below 6.4.1, making this update essential for maintaining security posture.
