Bug 772146 (CVE-2021-20230)

Summary:	<net-misc/stunnel-5.58: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	blueness, conikost
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [glsa+ cve]
Package list:		Runtime testing required:	No

Description Sam James archtester

2021-02-22 10:37:46 UTC

From 5.57 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)."

From 5.58 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle unauthenticated requests (thx to Martin Stein).
Fixed a double free with OpenSSL older than 1.1.0 (thx to Petr Strukov)."

Comment 1 Sam James archtester

2021-02-22 10:38:13 UTC

(In reply to Sam James from comment #0)
> [...]
> 
> From 5.58 NEWS:
> 
> "Security bugfixes
> The "redirect" option was fixed to properly handle unauthenticated requests
> (thx to Martin Stein).

I believe this is CVE-2021-20230.

Comment 2 Conrad Kostecki gentoo-dev

2021-03-15 20:18:08 UTC

FYI: I bumped after speaking to blueness to 5.58.

https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487

Comment 3 John Helmert III archtester

2021-03-16 12:38:05 UTC

(In reply to Conrad Kostecki from comment #2)
> FYI: I bumped after speaking to blueness to 5.58.
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/
> stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487

Thanks! Please proceed with stabilization when ready.

Comment 4 Sam James archtester

2021-03-28 05:43:06 UTC

Ping

Comment 5 Agostino Sarubbo gentoo-dev

2021-03-29 11:51:04 UTC

amd64 stable

Comment 6 Sam James archtester

2021-03-29 14:49:59 UTC

arm done

Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev

2021-03-30 01:17:30 UTC

x86 stable

Comment 8 Rolf Eike Beer archtester

2021-03-30 14:54:23 UTC

sparc stable

Comment 9 Sam James archtester

2021-03-30 22:06:03 UTC

ppc64 done

Comment 10 Sam James archtester

2021-03-30 22:06:16 UTC

ppc done

all arches done

Comment 11 Anthony Basile gentoo-dev

2021-04-01 11:33:41 UTC

cleanup of vulnerable version done

Comment 12 Thomas Deutschmann (RETIRED) gentoo-dev

2021-05-25 22:48:11 UTC

New GLSA request filed.

Comment 13 GLSAMaker/CVETool Bot gentoo-dev

2021-05-26 08:05:10 UTC

This issue was resolved and addressed in
 GLSA 202105-02 at https://security.gentoo.org/glsa/202105-02
by GLSA coordinator Thomas Deutschmann (whissi).