ST
Product
Stunnel
12
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 0Low 0
Watch
Add Stunnel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-20230 | 7.5 | Feb 23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options Affected: before 5.57 |
| CVE-2015-3644 | – | May 14 | Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers… Affected: 5.00; 5.01; 5.02; 5.03; 5.04; 5.05; +8 more |
| CVE-2014-0016 | – | Mar 24 | stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the… Affected: through 4.56; 0.1; 1.0; 1.1; 1.2; 1.3; +34 more |
| CVE-2013-1762 | – | Mar 8 | stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers… Affected: through 4.54; 4.21; 4.22; 4.23; 4.24; 4.25; +28 more |
| CVE-2011-2940 | – | Aug 25 | stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors Affected: 4.40; 4.41 |
| CVE-2008-2420 | – | May 23 | The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by… Affected: 3.4a; 3.5; 3.6; 3.7; 3.8; 3.8p1; +34 more |
| CVE-2008-2400 | – | May 22 | Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors Affected: 0.1; 1.0; 1.1; 1.2; 1.3; 1.4; +34 more |
| CVE-2003-0740 | – | Oct 20 | Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server Affected: 3.3; 3.4a; 3.7; 3.8; 3.9; 3.10; +17 more |
| CVE-2002-1563 | – | May 12 | stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the child counter Affected: 4.04 |
| CVE-2003-0147 | – | Mar 31 | OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the… Affected: 3.7; 3.8; 3.9; 3.10; 3.11; 3.12; +15 more |
| CVE-2002-0002 | – | Jan 31 | Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbitrary code Affected: 3.3; 3.4a; 3.7; 3.8; 3.9; 3.10; +16 more |
| CVE-2001-0060 | – | Feb 12 | Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username Affected: 3.3; 3.4a; 3.7; 3.8 |
Showing 12