Skip to content
Fencer Vulns
high 7.5

CVE-2021-20230 json

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and v…

published 2021-02-23 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-7669

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Patch / fix

  • stunnel stunnel 5.57
  • stunnel4 Debian 13, Debian 12 3:5.56+dfsg-8

debian advisories DEBIAN-CVE-2021-20230

  • stunnel4 Ubuntu 20.04 LTS 3:5.56-1ubuntu0.2
  • stunnel4 Ubuntu Pro 18.04 LTS 3:5.44-1ubuntu3+esm1

ubuntu advisories UBUNTU-CVE-2021-20230

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • stunnel RHEL 8 5.56-5.el8_3
  • stunnel RHEL 8.1 EUS 5.48-6.el8_1
  • stunnel RHEL 8.2 EUS 5.48-6.el8_2

red hat advisories RHSA-2021:0620RHSA-2021:0618RHSA-2021:0619

  • stunnel SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +10 more 5.44-3.8.1
  • stunnel SLE Module for Server Applications 15 SP2 5.57-3.11.1

suse advisories SUSE-SU-2021:1465-1SUSE-SU-2021:0772-1

  • stunnel openSUSE Leap 15.2 5.57-lp152.2.6.1

opensuse advisories openSUSE-SU-2021:0409-1

  • stunnel AlmaLinux 8 5.56-5.el8_3

almalinux advisories ALSA-2021:0618

  • stunnel Rocky Linux 8 5.56-5.el8_3

rocky linux advisories RLSA-2021:0618

  • stunnel CBL-Mariner 2.0 5.70-1

azure linux advisories AZL-7375

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20230 updated cvss 7.5

stunnel: client certificate not correctly verified when redirect and verifyChain options are used

  • Red Hat Enterprise Linux BaseOS (v. 8) stunnel 5.56-5.el8_3
    fixed: vendor fix RHSA-2021:0618
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) stunnel 5.48-6.el8_1
    fixed: vendor fix RHSA-2021:0620
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) stunnel 5.48-6.el8_2
    fixed: vendor fix RHSA-2021:0619
  • Red Hat Enterprise Linux 5 stunnel Red Hat Enterprise Linux 6 stunnel Red Hat Enterprise Linux 7 stunnel Red Hat Enterprise Linux 9 stunnel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a stunnel

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.