CVE-2021-20230

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption.

Security Fix(es):

• stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption.

Security Fix(es):

• stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Attacker bypasses redirection using unauthorized CA-signed certificate.
  • debian/patches/CVE-2021-20230.patch: Patch enhancing certificate verification process to prevent unauthorized redirection with CA-signed certificates by refining session data checks.
  • CVE-2021-20230
• Fix tests:
  • debian/patches/renew-cert-script.patch: Add script that re-generate expired test certs.
• Repacked orig source tarball with renewed certs.
• Removed no longer required patch, that mute tests with expired certificates.

Updated stunnel package fixes security vulnerability:

Client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230).

This update for stunnel fixes the following issues:

• Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]
  • 'redirect' option does not properly handle 'verifyChain = yes'

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for stunnel fixes the following issues:

• Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]
  • 'redirect' option does not properly handle 'verifyChain = yes'

This update for stunnel fixes the following issues:

• Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]
  • 'redirect' option does not properly handle 'verifyChain = yes'

It was discovered that stunnel did not properly validate client certificates when configured to use both the redirect and verifyChain options. A remote attacker could potentially use this issue to obtain sensitive information by accessing the tunneled service.