Unscored severity · published May 23, 2008
CVE-2008-2420
The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Stunnel · Stunnel
3.4a; 3.5; 3.6; 3.7; 3.8; 3.8p1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2420
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2420
Vendor Advisory
http://secunia.com/advisories/30335
secunia.com
http://secunia.com/advisories/30425
secunia.com
http://secunia.com/advisories/31438
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200808-08.xml
stunnel.mirt.net
http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2008:168
More from Stunnel
7.5
CVE-2021-20230
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options
–
CVE-2015-3644
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers…
–
CVE-2014-0016
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the…
–
CVE-2013-1762
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers…
–
CVE-2011-2940
stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors