Stunnel was not properly verifying TLS certificates, possibly allowing an integrity/confidentiality compromise.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/stunnel | * | < 5.58 | >= 5.58 |
The stunnel program is designed to work as an SSL/TLS encryption wrapper between a client and a local or remote server.
It was discovered that stunnel did not correctly verified the client certificate when options “redirect” and “verifyChain” are used.
A remote attacker could send a specially crafted certificate, possibly resulting in a breach of integrity or confidentiality.
There is no known workaround at this time.
All stunnel users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-5.58"
A vulnerability in stunnel might allow remote attackers to gain access to private key information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/stunnel | * | < 5.02 | >= 5.02 |
The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server.
stunnel does not properly update the state of the pseudo-random generator after fork-threading which causes subsequent children with the same process ID to use the same entropy pool. ECDSA and DSA keys, when not used in deterministic mode (RFC6979), rely on random data for its k parameter to not leak private key information.
A remote attacker may gain access to private key information from ECDSA or DSA keys.
There is no known workaround at this time.
All stunnel users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-5.02"
A vulnerability has been found in stunnel, allowing for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/stunnel | * | < 4.56-r1 | >= 4.56-r1, < 4.00 |
The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server.
A buffer overflow vulnerability has been discovered in stunnel. Please review the CVE identifier referenced below for details.
A remote attacker could entice a user to connect to a malicious proxy server, resulting in the execution of arbitrary code within the configured chroot directory, with the privileges of the user running stunnel. Please review the references below for details.
There is no known workaround at this time.
All stunnel users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.56-r1"
A vulnerability was found in stunnel, allowing remote attackers to cause a Denial of Service and potentially arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/stunnel | * | < 4.44 | >= 4.44, < 4 |
The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server.
An unspecified heap vulnerability was discovered in stunnel.
The vulnerability may possibly be leveraged to perform remote code execution or a Denial of Service attack.
There is no known workaround at this time.
All stunnel 4.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.44"
stunnel does not properly prevent the authentication of a revoked certificate which would be published by OCSP.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/stunnel | * | < 4.24 | >= 4.24, < 4 |
The stunnel program is designed to work as an SSL encryption wrapper between a remote client and a local or remote server. OCSP (Online Certificate Status Protocol), as described in RFC 2560, is an internet protocol used for obtaining the revocation status of an X.509 digital certificate.
An unspecified bug in the OCSP search functionality of stunnel has been discovered.
A remote attacker can use a revoked certificate that would be successfully authenticated by stunnel. This issue only concerns the users who have enabled the OCSP validation in stunnel.
There is no known workaround at this time.
All stunnel users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.24"
An error in the usage of the ssl-cert eclass within multiple ebuilds might allow for disclosure of generated SSL private keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/conserver | * | < 8.1.16 | >= 8.1.16 |
| mail-mta/postfix | * | < 2.4.6-r2 | >= 2.4.6-r2, >= 2.3.8-r1 (revision), >= 2.2.11-r1 (revision) |
| net-ftp/netkit-ftpd | * | < 0.17-r7 | >= 0.17-r7 |
| net-im/ejabberd | * | < 1.1.3 | >= 1.1.3 |
| net-irc/unrealircd | * | < 3.2.7-r2 | >= 3.2.7-r2 |
| net-mail/cyrus-imapd | * | < 2.3.9-r1 | >= 2.3.9-r1 |
| net-mail/dovecot | * | < 1.0.10 | >= 1.0.10 |
| net-misc/stunnel | * | < 4.21-r1 | >= 4.21-r1, < 4.0 |
| net-nntp/inn | * | < 2.4.3-r1 | >= 2.4.3-r1 |
The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates.
Robin Johnson reported that the docert() function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as src_compile() or src_install(), which will result in the generated SSL keys being included inside binary packages (binpkgs).
A local attacker could recover the SSL keys from publicly readable binary packages when "emerge" is called with the "--buildpkg (-b)" or "--buildpkgonly (-B)" option. Remote attackers can recover these keys if the packages are served to a network. Binary packages built using "quickpkg" are not affected.
Do not use pre-generated SSL keys, but use keys that were generated using a different Certificate Authority.
Upgrading to newer versions of the above packages will neither remove possibly compromised SSL certificates, nor old binary packages. Please remove the certificates installed by Portage, and then emerge an upgrade to the package.
All Conserver users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/conserver-8.1.16"
All Postfix 2.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.4.6-r2"
All Postfix 2.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.3.8-r1"
All Postfix 2.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.2.11-r1"
All Netkit FTP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/netkit-ftpd-0.17-r7"
All ejabberd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-im/ejabberd-1.1.3"
All UnrealIRCd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/unrealircd-3.2.7-r2"
All Cyrus IMAP Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.3.9-r1"
All Dovecot users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.10"
All stunnel 4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.21"
All InterNetNews users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nntp/inn-2.4.3-r1"