Splunk Supporting Add-on for Active Directory Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in versions 3.1.0 and earlier of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch. The issue arises from a vulnerable regular expression pattern that can be exploited to cause a denial-of-service condition by degrading the performance of the application.

Impact

Exploitation of this vulnerability can lead to a Regular Expression Denial-of-Service (ReDoS) condition, where an attacker can cause the application to consume excessive resources, potentially leading to degraded performance or unresponsiveness.

Remediation

Users are advised to upgrade the Splunk Supporting Add-on for Active Directory to version 3.1.1 or higher.