In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).
Weakness
An exception is thrown from a function, but it is not caught.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Splunk | Splunk | 8.1.0 (including) | 8.1.13 (excluding) |
| Splunk | Splunk | 8.2.0 (including) | 8.2.10 (excluding) |
| Splunk | Splunk | 9.0.0 (including) | 9.0.4 (excluding) |
| Splunk_cloud_platform | Splunk | * | 9.0.2209.3 (excluding) |