PatchTheCVECVE-2021-20230: A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configur
CVE-2021-20230 is a high-severity flaw (CVSS 7.5) affecting stunnel. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is t
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 32%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2021-02-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-20230?
stunnel: upgrade to 5.57. Exact commands for each OS are on this page.
Is CVE-2021-20230 being exploited?
CVE-2021-20230 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-20230 affect?
CVE-2021-20230 affects stunnel. Severity is high (CVSS 7.5). A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority
How urgent is CVE-2021-20230?
Priority 48/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2015-3644 MEDIUM 5.8 DOWNGRADE Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expecte
- CVE-2014-0016 MEDIUM 4.3 UPGRADE stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-rando
- CVE-2013-1762 MEDIUM 6.6 UPGRADE stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not cor
- CVE-2011-2940 HIGH 9.3 DOWNGRADE stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (hea