CVE-2015-3644
Fixed in a distro release EPSS 2%
Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers to bypass authentication.
Products: stunnel
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | stunnel4 | 3:5.18-1 |
| Debian 13 | stunnel4 | 3:5.18-1 |
| Debian 8 | stunnel4 | 3:5.06-2+deb8u1 |
| SUSE Linux Enterprise Server 12 | stunnel | 5.00-3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | stunnel | 5.00-3.1 |
| openSUSE Tumbleweed | stunnel | 5.65-1.1 |