Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 772146 (CVE-2021-20230)

Summary: <net-misc/stunnel-5.58: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: blueness, conikost
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B4 [glsa+ cve]
Package list:
Runtime testing required: No

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-02-22 10:37:46 UTC
From 5.57 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)."

From 5.58 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle unauthenticated requests (thx to Martin Stein).
Fixed a double free with OpenSSL older than 1.1.0 (thx to Petr Strukov)."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-02-22 10:38:13 UTC
(In reply to Sam James from comment #0)
> [...]
> 
> From 5.58 NEWS:
> 
> "Security bugfixes
> The "redirect" option was fixed to properly handle unauthenticated requests
> (thx to Martin Stein).

I believe this is CVE-2021-20230.
Comment 2 Conrad Kostecki gentoo-dev 2021-03-15 20:18:08 UTC
FYI: I bumped after speaking to blueness to 5.58.

https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-16 12:38:05 UTC
(In reply to Conrad Kostecki from comment #2)
> FYI: I bumped after speaking to blueness to 5.58.
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/
> stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487

Thanks! Please proceed with stabilization when ready.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-03-28 05:43:06 UTC
Ping
Comment 5 Agostino Sarubbo gentoo-dev 2021-03-29 11:51:04 UTC
amd64 stable
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-03-29 14:49:59 UTC
arm done
Comment 7 Thomas Deutschmann gentoo-dev 2021-03-30 01:17:30 UTC
x86 stable
Comment 8 Rolf Eike Beer archtester 2021-03-30 14:54:23 UTC
sparc stable
Comment 9 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-03-30 22:06:03 UTC
ppc64 done
Comment 10 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-03-30 22:06:16 UTC
ppc done

all arches done
Comment 11 Anthony Basile gentoo-dev 2021-04-01 11:33:41 UTC
cleanup of vulnerable version done
Comment 12 Thomas Deutschmann gentoo-dev 2021-05-25 22:48:11 UTC
New GLSA request filed.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2021-05-26 08:05:10 UTC
This issue was resolved and addressed in
 GLSA 202105-02 at https://security.gentoo.org/glsa/202105-02
by GLSA coordinator Thomas Deutschmann (whissi).