Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 772146 (CVE-2021-20230) - <net-misc/stunnel-5.58: client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230)
Summary: <net-misc/stunnel-5.58: client certificate not correctly verified when redire...
Status: RESOLVED FIXED
Alias: CVE-2021-20230
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-22 10:37 UTC by Sam James
Modified: 2021-05-26 08:05 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: No


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester gentoo-dev Security 2021-02-22 10:37:46 UTC
From 5.57 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle "verifyChain = yes" (thx to Rob Hoes)."

From 5.58 NEWS:

"Security bugfixes
The "redirect" option was fixed to properly handle unauthenticated requests (thx to Martin Stein).
Fixed a double free with OpenSSL older than 1.1.0 (thx to Petr Strukov)."
Comment 1 Sam James archtester gentoo-dev Security 2021-02-22 10:38:13 UTC
(In reply to Sam James from comment #0)
> [...]
> 
> From 5.58 NEWS:
> 
> "Security bugfixes
> The "redirect" option was fixed to properly handle unauthenticated requests
> (thx to Martin Stein).

I believe this is CVE-2021-20230.
Comment 2 Conrad Kostecki gentoo-dev 2021-03-15 20:18:08 UTC
FYI: I bumped after speaking to blueness to 5.58.

https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487
Comment 3 John Helmert III gentoo-dev Security 2021-03-16 12:38:05 UTC
(In reply to Conrad Kostecki from comment #2)
> FYI: I bumped after speaking to blueness to 5.58.
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/net-misc/
> stunnel?id=021b0cccd5ea0f8b0cdb764ef696a71a5e430487

Thanks! Please proceed with stabilization when ready.
Comment 4 Sam James archtester gentoo-dev Security 2021-03-28 05:43:06 UTC
Ping
Comment 5 Agostino Sarubbo gentoo-dev 2021-03-29 11:51:04 UTC
amd64 stable
Comment 6 Sam James archtester gentoo-dev Security 2021-03-29 14:49:59 UTC
arm done
Comment 7 Thomas Deutschmann gentoo-dev Security 2021-03-30 01:17:30 UTC
x86 stable
Comment 8 Rolf Eike Beer 2021-03-30 14:54:23 UTC
sparc stable
Comment 9 Sam James archtester gentoo-dev Security 2021-03-30 22:06:03 UTC
ppc64 done
Comment 10 Sam James archtester gentoo-dev Security 2021-03-30 22:06:16 UTC
ppc done

all arches done
Comment 11 Anthony Basile gentoo-dev 2021-04-01 11:33:41 UTC
cleanup of vulnerable version done
Comment 12 Thomas Deutschmann gentoo-dev Security 2021-05-25 22:48:11 UTC
New GLSA request filed.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2021-05-26 08:05:10 UTC
This issue was resolved and addressed in
 GLSA 202105-02 at https://security.gentoo.org/glsa/202105-02
by GLSA coordinator Thomas Deutschmann (whissi).