Splunk: CVE-2021-3422: Indexer denial-of-service via malformed S2S request

The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. SeeEnable a receiverfor more information on configuring an indexer to listen for UF traffic. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. As a partial mitigation and a security best practice, seeConfigure Splunk forwarding to use your own SSL certificatesandControl forwarder access. Implementation of either or both reduces the severity to Medium.