Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ MGASA-2022-0109 — stunnel

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Updated stunnel packages fix security vulnerability

Update to 5.62 including new features and bugfixes:

Security bugfixes

  • The "redirect" option was fixed to properly handle unauthenticated

requests (bsc#1182529).

  • Fixed a double free with OpenSSL older than 1.1.0.
  • Added hardening to systemd service (bsc#1181400).

New features

  • Added new "protocol = capwin" and "protocol = capwinctrl"

configuration file options.

  • Added support for the new SSL_set_options() values.
  • Added a bash completion script.
  • New 'sessionResume' service-level option to allow or disallow

session resumption

  • Download fresh ca-certs.pem for each new release.
  • New 'protocolHeader' service-level option to insert custom 'connect'

protocol negotiation headers. This feature can be used to

impersonate other software (e.g. web browsers).

  • 'protocolHost' can also be used to control the client SMTP protocol

negotiation HELO/EHLO value.

  • Initial FIPS 3.0 support.
  • Client-side "protocol = ldap" support

Bugfixes

  • Fixed a transfer() loop bug.
  • Fixed reloading configuration with "systemctl reload

stunnel.service".

  • Fixed incorrect messages logged for OpenSSL errors.
  • Fixed 'redirect' with 'protocol'. This combination is not supported

by 'smtp', 'pop3' and 'imap' protocols.

  • X.509v3 extensions required by modern versions of OpenSSL are added

to generated self-signed test certificates.

  • Fixed a tiny memory leak in configuration file reload error handling.
  • Fixed engine initialization.
  • FIPS TLS feature is reported when a provider or container is

available, and not when FIPS control API is available.

  • Fix configuration reload when compression is used
  • Fix test suite fixed not to require external connectivity

Affected software

MGASA-2022-0109 is recorded against 1 package.

  • stunnel (fixed in 5.63-1.mga8)

Timeline and source

Published on 21 March 2022 and last revised on 16 April 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

advisories.mageia.org (Advisory)
bugs.mageia.org (Report)
lists.suse.com (Web)
lists.opensuse.org (Web)

Other advisories for this package

stunnel has other advisories on record. If you are patching this one, these are worth checking on the same host:

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2022-03-21
Updated 2026-08-20
Modified 2026-04-16
Fix URL N/A

Affected Packages

Software From version Fixed in
stunnel — 5.63-1.mga8

Similar Threats

Free Vulnerability Check

Is your site affected by MGASA-2022-0109?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MGASA-2022-0109 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesMageiaMageia 2022
✓