CVE-2021-20230

HIGH Year: 2021
CVSS v3 Score
7.5
High
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-295
View all →

Vulnerability Description

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Related Vulnerabilities

CVE-2009-3046

HIGH
CVSS:7.5(High)

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certifica...

CWE-2952009

CVE-2009-4123

HIGH
CVSS:7.5(High)

The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation.

CWE-2952009

CVE-2012-5518

HIGH
CVSS:7.5(High)

vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)

CWE-2952012

CVE-2012-6071

HIGH
CVSS:7.5(High)

nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.

CWE-2952012

CVE-2013-0264

HIGH
CVSS:7.5(High)

An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system...

CWE-2952013

CVE-2013-7450

HIGH
CVSS:7.5(High)

Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.

CWE-2952013