{"answers":{"affected":"","exploited":"There is no known exploitation of SUSE-SU-2022:0872-1 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"SUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for SUSE-SU-2022:0872-1 and fix it if it is affected.\n\nWhat it is: SUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of SUSE-SU-2022:0872-1 in the wild and no public exploit code.\n\nAffected product: stunnel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/SUSE-SU-2022-0872-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2022-0872-1/index.md)","id":"SUSE-SU-2022:0872-1","markdown":"https://insights.sbomify.com/SUSE-SU-2022-0872-1/index.md","name":"SUSE-SU-2022:0872-1","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SSL/TLS tunneling software","requires_auth":"none","summary":"An attacker can trigger a double free vulnerability in stunnel, potentially leading to code execution or denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for stunnel fixes the following issues:\n\nUpdate to 5.62 including new features and bugfixes:\n\n  * Security bugfixes\n    - The 'redirect' option was fixed to properly handle unauthenticated requests (bsc#1182529).\n    - Fixed a double free with OpenSSL older than 1.1.0.\n    - Added hardening to systemd service (bsc#1181400).\n  * New features\n    - Added new 'protocol = capwin' and 'protocol = capwinctrl' configuration file options.\n    - Added support for the new SSL_set_options() values.\n    - Added a bash completion script.\n    - New 'sessionResume' service-level option to allow or disallow session resumption\n    - Download fresh ca-certs.pem for each new release.\n    - New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers.\n      This feature can be used to impersonate other software (e.g. web browsers).\n    - 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value.\n    - Initial FIPS 3.0 support.\n    - Client-side 'protocol = ldap' support\n  * Bugfixes\n    - Fixed a transfer() loop bug.\n    - Fixed reloading configuration with 'systemctl reload stunnel.service'.\n    - Fixed incorrect messages logged for OpenSSL errors.\n    - Fixed 'redirect' with 'protocol'.  This combination is not supported by 'smtp', 'pop3' and 'imap' protocols.\n    - X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates.\n    - Fixed a tiny memory leak in configuration file reload error handling.\n    - Fixed engine initialization.\n    - FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available.\n    - Fix configuration reload when compression is used\n    - Fix test suite fixed not to require external connectivity","ecosystems":["SUSE:Enterprise Storage 7","SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","SUSE:Linux Enterprise Module for Server Applications 15 SP3","SUSE:Linux Enterprise Real Time 15 SP2","SUSE:Linux Enterprise Server 15 SP2-BCL","SUSE:Linux Enterprise Server 15 SP2-LTSS","SUSE:Linux Enterprise Server for SAP Applications 15 SP2","SUSE:Manager Proxy 4.1","SUSE:Manager Retail Branch Server 4.1","SUSE:Manager Server 4.1"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for stunnel","id":"SUSE-SU-2022:0872-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2022"},"n_packages":11,"n_references":null,"packages":[{"ecosystem":"SUSE:Enterprise Storage 7","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Enterprise%20Storage%207","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOS","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP3","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCL","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Manager Proxy 4.1","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Manager%20Proxy%204.1","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1","source":"SUSE-SU-2022:0872-1"},{"ecosystem":"SUSE:Manager Server 4.1","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/suse/stunnel\u0026distro=SUSE%20Manager%20Server%204.1","source":"SUSE-SU-2022:0872-1"}],"products":null,"published":"2022-03-16","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can trigger a double free vulnerability in stunnel, potentially leading to code execution or denial of service.","url":"https://insights.sbomify.com/SUSE-SU-2022-0872-1/"}