CVE-2021-20230 — Improper Certificate Validation in Stunnel
Severity
7.5HIGHNVD
EPSS
0.2%
top 56.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 23
Latest updateJul 18
Description
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages2 packages
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4Microsoft▶
A flaw was found in stunnel before 5.57 where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certif↗2021-02-09
Debian▶
CVE-2021-20230: stunnel4 - A flaw was found in stunnel before 5.57, where it improperly validates client ce...↗2021
Red Hat▶
stunnel: client certificate not correctly verified when redirect and verifyChain options are used↗2020-10-11