openSUSE-SU-2022:0872-1 Security update for stunnel
Not scored
Published
Check this codebase for openSUSE-SU-2022:0872-1 and fix it if it is affected.
What it is: openSUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of openSUSE-SU-2022:0872-1 in the wild and no public exploit code.
Affected product: stunnel. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/openSUSE-SU-2022-0872-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2022-0872-1/index.md)
An attacker can trigger a double free vulnerability in stunnel, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2022:0872-1?
openSUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for stunnel fixes the following issues:
Update to 5.62 including new features and bugfixes:
- Security bugfixes
- The 'redirect' option was fixed to properly handle unauthenticated requests (bsc#1182529).
- Fixed a double free with OpenSSL older than 1.1.0.
- Added hardening to systemd service (bsc#1181400).
- New features
- Added new 'protocol = capwin' and 'protocol = capwinctrl' configuration file options.
- Added support for the new SSL_set_options() values.
- Added a bash completion script.
- New 'sessionResume' service-level option to allow or disallow session resumption
- Download fresh ca-certs.pem for each new release.
- New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers).
- 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value.
- Initial FIPS 3.0 support.
- Client-side 'protocol = ldap' support
- Bugfixes
- Fixed a transfer() loop bug.
- Fixed reloading configuration with 'systemctl reload stunnel.service'.
- Fixed incorrect messages logged for OpenSSL errors.
- Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols.
- X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates.
- Fixed a tiny memory leak in configuration file reload error handling.
- Fixed engine initialization.
- FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available.
- Fix configuration reload when compression is used
- Fix test suite fixed not to require external connectivity
Which versions are affected by openSUSE-SU-2022:0872-1?
Linux distribution packages (1)
stunnel openSUSE:Leap 15.3 | All versions | 5.62-3.14.1 |
How do I fix openSUSE-SU-2022:0872-1?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is openSUSE-SU-2022:0872-1 being exploited?
There is no known exploitation of openSUSE-SU-2022:0872-1 in the wild and no public exploit code.