SB2025061310 - Splunk Python for Scientific Computing update for third-party components

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper authentication (CVE-ID: CVE-2024-12797)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when using RFC7250 Raw Public Keys (RPKs) to authenticate a server. TLS and DTLS connections using raw public keys are vulnerable to man-in-middle attacks when server authentication failure is not detected by clients.

Note, the vulnerability can be exploited only when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2025-32434)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data when loading a model using torch.load with weights_only=True. A remote attacker can trick the victim into loading a specially crafted model and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://advisory.splunk.com/advisories/SVD-2025-0605