{"answers":{"affected":"","exploited":"There is no known exploitation of openSUSE-SU-2022:0872-1 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"openSUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for openSUSE-SU-2022:0872-1 and fix it if it is affected.\n\nWhat it is: openSUSE-SU-2022:0872-1 is a memory corruption vulnerability in stunnel, published on 16 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of openSUSE-SU-2022:0872-1 in the wild and no public exploit code.\n\nAffected product: stunnel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/openSUSE-SU-2022-0872-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2022-0872-1/index.md)","id":"openSUSE-SU-2022:0872-1","markdown":"https://insights.sbomify.com/openSUSE-SU-2022-0872-1/index.md","name":"openSUSE-SU-2022:0872-1","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SSL/TLS tunneling software","requires_auth":"none","summary":"An attacker can trigger a double free vulnerability in stunnel, potentially leading to code execution or denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for stunnel fixes the following issues:\n\nUpdate to 5.62 including new features and bugfixes:\n\n  * Security bugfixes\n    - The 'redirect' option was fixed to properly handle unauthenticated requests (bsc#1182529).\n    - Fixed a double free with OpenSSL older than 1.1.0.\n    - Added hardening to systemd service (bsc#1181400).\n  * New features\n    - Added new 'protocol = capwin' and 'protocol = capwinctrl' configuration file options.\n    - Added support for the new SSL_set_options() values.\n    - Added a bash completion script.\n    - New 'sessionResume' service-level option to allow or disallow session resumption\n    - Download fresh ca-certs.pem for each new release.\n    - New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers.\n      This feature can be used to impersonate other software (e.g. web browsers).\n    - 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value.\n    - Initial FIPS 3.0 support.\n    - Client-side 'protocol = ldap' support\n  * Bugfixes\n    - Fixed a transfer() loop bug.\n    - Fixed reloading configuration with 'systemctl reload stunnel.service'.\n    - Fixed incorrect messages logged for OpenSSL errors.\n    - Fixed 'redirect' with 'protocol'.  This combination is not supported by 'smtp', 'pop3' and 'imap' protocols.\n    - X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates.\n    - Fixed a tiny memory leak in configuration file reload error handling.\n    - Fixed engine initialization.\n    - FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available.\n    - Fix configuration reload when compression is used\n    - Fix test suite fixed not to require external connectivity","ecosystems":["openSUSE:Leap 15.3"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for stunnel","id":"openSUSE-SU-2022:0872-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2022"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"openSUSE:Leap 15.3","fixed":["5.62-3.14.1"],"introduced":["0"],"last_affected":[],"package":"stunnel","purl":"pkg:rpm/opensuse/stunnel\u0026distro=openSUSE%20Leap%2015.3","source":"openSUSE-SU-2022:0872-1"}],"products":null,"published":"2022-03-16","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can trigger a double free vulnerability in stunnel, potentially leading to code execution or denial of service.","url":"https://insights.sbomify.com/openSUSE-SU-2022-0872-1/"}