PT-2022-37439 · Stunnel+2 · Stunnel+2
Published
2022-03-16
·
Updated
2022-03-16
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
stunnel versions prior to 5.62
Description
The issue involves security bugfixes, including a fix for the 'redirect' option to properly handle unauthenticated requests and a fix for a double free with OpenSSL older than 1.1.0. Additionally, hardening has been added to the systemd service. New features include support for the new SSL set options() values, a bash completion script, and initial FIPS 3.0 support. Various bugfixes have also been implemented, such as fixing a transfer() loop bug and reloading configuration issues.
Recommendations
Update to stunnel version 5.62 or later to address the security bugfixes and other issues. As a temporary workaround, consider disabling the
redirect option until a patch is available. Restrict access to the systemd service to minimize the risk of exploitation. Avoid using OpenSSL older than 1.1.0 until the double free issue is resolved. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openssl
Stunnel
Systemd