{"id":"CVE-2021-20230","aliases":["ALSA-2021:0618","AZL-7375","CLSA-2023-1689701258","DEBIAN-CVE-2021-20230","EUVD-2021-7669","GHSA-wwrq-59mq-v8w2","MGASA-2021-0284","RHSA-2021:0618","RHSA-2021:0619","RHSA-2021:0620","RLSA-2021:0618","SUSE-SU-2021:0772-1","SUSE-SU-2021:1465-1","UBUNTU-CVE-2021-20230","USN-6901-1","openSUSE-SU-2021:0409-1"],"status":"published","title":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when...","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01179,"percentile":0.68074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-02-22T09:54:57Z","modified":"2026-10-29T11:00:25Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"stunnel","fixed_in":["5.56-5.el8_3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"stunnel","fixed_in":["5.70-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"stunnel4","fixed_in":["3:5.44-1ubuntu3+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"stunnel4","fixed_in":["3:5.56+dfsg-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"stunnel4","fixed_in":["3:5.56+dfsg-8"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"stunnel","fixed_in":["5.57-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel","fixed_in":["0:5.56-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel-debuginfo","fixed_in":["0:5.56-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel-debugsource","fixed_in":["0:5.56-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel","fixed_in":["0:5.48-6.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel-debuginfo","fixed_in":["0:5.48-6.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel-debugsource","fixed_in":["0:5.48-6.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel","fixed_in":["0:5.48-6.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel-debuginfo","fixed_in":["0:5.48-6.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel-debugsource","fixed_in":["0:5.48-6.el8_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"stunnel","fixed_in":["0:5.56-5.el8_3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"stunnel","fixed_in":["5.57-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"stunnel","fixed_in":["5.44-3.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"stunnel4","fixed_in":["3:5.44-1ubuntu3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"stunnel4","fixed_in":["3:5.56-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"stunnel","fixed_in":["5.57-lp152.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.56-5.el8_3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.70-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.44-1ubuntu3+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.56+dfsg-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.56+dfsg-8"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.57-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.56-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.56-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"stunnel-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.56-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"stunnel-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"stunnel-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.48-6.el8_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.56-5.el8_3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.57-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-3.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.44-1ubuntu3+esm1"}]}],"versions":["3:5.39-2","3:5.42-1","3:5.44-1ubuntu1","3:5.44-1ubuntu2","3:5.44-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.56-1ubuntu0.2"}]}],"versions":["3:5.55-2build1","3:5.56-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.44-1ubuntu3+esm1"}]}],"versions":["3:5.39-2","3:5.42-1","3:5.44-1ubuntu1","3:5.44-1ubuntu2","3:5.44-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"stunnel4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.56-1ubuntu0.2"}]}],"versions":["3:5.55-2build1","3:5.56-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"stunnel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.57-lp152.2.6.1"}]}]}],"products":[{"vendor":"microsoft","product":"stunnel"},{"vendor":"stunnel","product":"stunnel"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925226","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/mtrojnar/stunnel/commit/ebad9ddc4efb2635f37174c9d800d06206f1edf9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202105-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20230","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wwrq-59mq-v8w2"},{"url":"https://errata.almalinux.org/8/ALSA-2021-0618.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-20230","tags":["report"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1689701258","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-20230","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0284.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28195","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0618","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0618.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20230","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0619","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0619.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0620","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0620.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0618","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210772-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177580","tags":["report"]},{"url":"https://bugzilla.suse.com/1182529","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20230","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211465-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-20230","tags":["report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1177580","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6901-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XVLGFTQ3NKK4IRG4YXB6DPOVNR7D5IAU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-20230","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T16:34:39Z","modified":"2024-08-03T17:30:07.599Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:32:55.19484Z"}],"euvd":[{"id":"EUVD-2021-7669","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T16:34:39Z","modified":"2024-08-03T17:30:07Z","updated_at":"2026-11-03T03:25:09.355483Z"}],"ghsa":[{"id":"GHSA-wwrq-59mq-v8w2","title":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when...","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-05-24T17:42:54Z","modified":"2023-01-29T05:05:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:45:53.268312Z"}],"nvd":[{"id":"CVE-2021-20230","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T17:15:13.753Z","modified":"2026-06-17T03:33:30.657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"AZL-7375","title":"CVE-2021-20230 affecting package stunnel for versions less than 5.70-1","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T17:15:13Z","modified":"2026-04-21T04:33:59.444483Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"CVE-2021-20230","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T17:15:13.753Z","modified":"2026-10-20T10:54:27.615030692Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-20230","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T17:15:13.753Z","modified":"2026-10-23T18:03:10.231626521Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"RHSA-2021:0618","title":"Red Hat Security Advisory: stunnel security update","status":"published","published":"2024-09-16T05:26:16Z","modified":"2025-11-22T12:17:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0619","title":"Red Hat Security Advisory: stunnel security update","status":"published","published":"2024-09-16T05:26:08Z","modified":"2025-11-22T12:17:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0620","title":"Red Hat Security Advisory: stunnel security update","status":"published","published":"2024-09-16T05:26:23Z","modified":"2025-11-22T12:17:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:0618","title":"Important: stunnel security update","description":"Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption.\n\nSecurity Fix(es):\n\n* stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-22T09:54:57Z","modified":"2026-02-04T18:00:05.886667Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-20230","description":"A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2021-02-23T17:15:00Z","modified":"2026-02-04T03:56:02.412381Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2021:0618","title":"Important: stunnel security update","description":"Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over an encrypted connection (encrypted using SSL or TLS) or to provide an encrypted means of connecting to services that do not natively support encryption.\n\nSecurity Fix(es):\n\n* stunnel: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-22T09:54:57Z","modified":"2026-10-29T11:00:25.424186981Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2023-1689701258","title":"Fix CVE(s): CVE-2021-20230","description":"\n   * SECURITY UPDATE: Attacker bypasses redirection using unauthorized\n     CA-signed certificate.\n     - debian/patches/CVE-2021-20230.patch: Patch enhancing certificate\n       verification process to prevent unauthorized redirection with\n       CA-signed certificates by refining session data checks.\n     - CVE-2021-20230\n   * Fix tests:\n     - debian/patches/renew-cert-script.patch: Add script that\n       re-generate expired test certs.\n   * Repacked orig source tarball with renewed certs.\n   * Removed no longer required patch, that mute tests with expired certificates.","status":"published","published":"2023-07-18T17:27:43Z","modified":"2026-06-04T10:03:42.359783Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"MGASA-2021-0284","title":"Updated tunnel packages fix security vulnerability","description":"Updated stunnel package fixes security vulnerability:\n\nClient certificate not correctly verified when redirect and verifyChain\noptions are used (CVE-2021-20230).\n","status":"published","published":"2021-06-23T17:11:28Z","modified":"2026-04-16T04:43:58.61708113Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0409-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]\n  * 'redirect' option does not properly handle 'verifyChain = yes'\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-03-14T14:10:42Z","modified":"2026-02-04T03:28:57.70815Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"SUSE-SU-2021:0772-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]\n  * 'redirect' option does not properly handle 'verifyChain = yes'\n","status":"published","published":"2021-03-12T10:56:28Z","modified":"2026-02-04T02:55:54.053587Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1465-1","title":"Security update for stunnel","description":"This update for stunnel fixes the following issues:\n\n- Security fix: [bsc#1177580, bsc#1182529, CVE-2021-20230]\n  * 'redirect' option does not properly handle 'verifyChain = yes'\n","status":"published","published":"2021-05-03T16:19:57Z","modified":"2026-02-04T04:28:11.317393Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-6901-1","title":"stunnel4 vulnerability","description":"It was discovered that stunnel did not properly validate client\ncertificates when configured to use both the redirect and verifyChain\noptions. A remote attacker could potentially use this issue to obtain\nsensitive information by accessing the tunneled service.\n","status":"published","published":"2024-07-18T05:18:18Z","modified":"2026-02-10T04:44:41Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}