PatchTheCVEstunnel vulnerabilities
Recent CVEs affecting stunnel products. 4 tracked.
stunnel has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2021-02-23. Highest priority: CVE-2021-20230 (score 48/100).
- CVE-2021-20230 HIGH 7.5 UPGRADE A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configur
- CVE-2015-3644 MEDIUM 5.8 DOWNGRADE Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expecte
- CVE-2014-0016 MEDIUM 4.3 UPGRADE stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-rando
- CVE-2013-1762 MEDIUM 6.6 UPGRADE stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not cor
FAQ
How do I fix stunnel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is stunnel being exploited right now?
None of the tracked stunnel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which stunnel CVE should I patch first?
CVE-2021-20230 currently ranks highest (48/100): A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configur.