GCVE - cpe:2.3:a:stunnel:stunnel:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:stunnel:stunnel:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Stunnel (`919884d8-77a4-5cd5-a541-2fbbee52ee89`)
Product	Stunnel (`a9734822-cf99-5dba-b3ad-fbe93e4d79b5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/stunnel4`	purl2cpe	2026-06-01 10:17:43.312118
`pkg:deb/ubuntu/stunnel4`	purl2cpe	2026-06-01 10:17:43.312121
`pkg:github/mtrojnar/stunnel`	purl2cpe	2026-06-01 10:17:43.312123
`pkg:gitlab/redhat/stunnel`	purl2cpe	2026-06-01 10:17:43.312126
`pkg:rpm/fedora/stunnel`	purl2cpe	2026-06-01 10:17:43.312129
`pkg:rpm/opensuse/stunnel`	purl2cpe	2026-06-01 10:17:43.312132

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-20230`	vulnerable	2026-06-08 05:29:08.779333	Details available A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality. Published: 2021-02-23T16:34:39.000Z Updated: 2024-08-03T17:30:07.599Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1925226 https://github.com/mtrojnar/stunnel/commit/ebad9ddc4efb2635f37174c9d800d06206f1edf9 https://security.gentoo.org/glsa/202105-02	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0016`	vulnerable	2026-06-08 05:05:10.659345	Details available stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates. Published: 2014-03-23T15:00:00.000Z Updated: 2024-08-06T08:58:26.561Z Open on db.gcve.eu Reference links https://www.stunnel.org/sdf_ChangeLog.html https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff http://www.openwall.com/lists/oss-security/2014/03/05/1 https://bugzilla.redhat.com/show_bug.cgi?id=1072180 http://www.securityfocus.com/bid/65964	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1762`	vulnerable	2026-06-08 05:03:56.138847	Details available stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow. Published: 2013-03-08T18:00:00.000Z Updated: 2024-08-06T15:13:32.427Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2013:130 http://rhn.redhat.com/errata/RHSA-2013-0714.html https://www.stunnel.org/CVE-2013-1762.html https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097 http://www.debian.org/security/2013/dsa-2664	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Stunnel

Notes

PURL mappings

Vulnerability references

Contribute