PatchTheCVEstunnel vulnerabilities and fixes
Recent CVEs affecting stunnel, with upgrade or downgrade steps. 5 tracked.
stunnel has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-02-23. Highest priority: CVE-2011-2940 (score 56/100).
- CVE-2021-20230 HIGH 7.5 UPGRADE A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configur
- CVE-2015-3644 MEDIUM 5.8 DOWNGRADE Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expecte
- CVE-2014-0016 MEDIUM 4.3 UPGRADE stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-rando
- CVE-2013-1762 MEDIUM 6.6 UPGRADE stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not cor
- CVE-2011-2940 HIGH 9.3 DOWNGRADE stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (hea
FAQ
How do I fix stunnel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is stunnel being exploited right now?
None of the tracked stunnel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which stunnel CVE should I patch first?
CVE-2011-2940 currently ranks highest (56/100): stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (hea.