CVE-2021-20230 Auth bypass in stunnel
Attackers with valid CA-signed certificates can bypass redirect restrictions to access tunneled services, compromising confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20230?
CVE-2021-20230 is a high-severity authentication bypass vulnerability in stunnel, published on 23 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.
Weakness: CWE-295
Which versions are affected by CVE-2021-20230?
It affects 1 product.
Linux distribution packages (26)
stunnel AlmaLinux:8 | All versions | 5.56-5.el8_3 |
stunnel Red Hat:enterprise_linux:8::baseos | All versions | 0:5.56-5.el8_3 |
stunnel-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:5.56-5.el8_3 |
stunnel-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:5.56-5.el8_3 |
stunnel Red Hat:rhel_eus:8.1::baseos | All versions | 0:5.48-6.el8_1 |
stunnel-debuginfo Red Hat:rhel_eus:8.1::baseos | All versions | 0:5.48-6.el8_1 |
stunnel-debugsource Red Hat:rhel_eus:8.1::baseos | All versions | 0:5.48-6.el8_1 |
stunnel Red Hat:rhel_eus:8.2::baseos | All versions | 0:5.48-6.el8_2 |
stunnel-debuginfo Red Hat:rhel_eus:8.2::baseos | All versions | 0:5.48-6.el8_2 |
stunnel-debugsource Red Hat:rhel_eus:8.2::baseos | All versions | 0:5.48-6.el8_2 |
stunnel Rocky Linux:8 | All versions | 0:5.56-5.el8_3 |
stunnel SUSE:Enterprise Storage 6 | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 5.57-3.11.1 |
stunnel SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise Server 15-LTSS | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 5.44-3.8.1 |
stunnel SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 5.44-3.8.1 |
stunnel SUSE:Manager Proxy 4.0 | All versions | 5.44-3.8.1 |
stunnel SUSE:Manager Retail Branch Server 4.0 | All versions | 5.44-3.8.1 |
stunnel SUSE:Manager Server 4.0 | All versions | 5.44-3.8.1 |
stunnel openSUSE:Leap 15.2 | All versions | 5.57-lp152.2.6.1 |
Products include Stunnel Stunnel.
How do I fix CVE-2021-20230?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-20230 being exploited?
There is no known exploitation of CVE-2021-20230 in the wild and no public exploit code.
Other vulnerabilities in stunnel
- CVE-2001-0060 Other in n/a
- CVE-2011-2940 Memory corruption in n/a
- CVE-2008-2400 Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors.
- CVE-2008-2420 Security feature bypass in n/a
- CVE-2013-1762 Integer overflow in n/a
Sources
Also known as ALSA-2021:0618, AZL-7375, CLSA-2023-1689701258, DEBIAN-CVE-2021-20230, GHSA-wwrq-59mq-v8w2, MGASA-2021-0284 and 9 more.