Bug 1221673 (CVE-2015-3644) - CVE-2015-3644 stunnel: authentication bypass with the "redirect" option
Summary: CVE-2015-3644 stunnel: authentication bypass with the "redirect" option
Alias: CVE-2015-3644
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1221674
TreeView+ depends on / blocked
Reported: 2015-05-14 14:15 UTC by Martin Prpič
Modified: 2021-02-17 05:18 UTC (History)
2 users (show)

Fixed In Version: stunnel 5.14
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-05-14 14:17:00 UTC

Attachments (Terms of Use)

Description Martin Prpič 2015-05-14 14:15:50 UTC
The following flaw was found in stunnel:

Normally, clients are connected to the host(s) specified with the "connect" option on authentication success, and rejected on authentication failure (untrusted client certificate). When the "redirect" option is specified, such connections are supposed to be forwarded to the host(s) specified with "redirect" rather then rejected.

In Stunnel versions 5.00 to 5.13, only the initial connection is redirected to the host(s) specified with "redirect". The subsequent connections established with reused SSL/TLS sessions are always forwarded to the host(s) specified with "connect" as if they were successfully authenticated.

The vulnerability is exploitable under the following conditions:

- Stunnel versions 5.00 to 5.13 inclusive.
- Server mode mode is enabled with "client = no" (which is the default).
- Certificate-based authentication is enabled with "verify = 2" or higher.
- The "redirect" option is used.

Upstream advisory:


Comment 1 Martin Prpič 2015-05-14 14:16:11 UTC
Created stunnel tracking bugs for this issue:

Affects: fedora-all [bug 1221674]

Comment 2 Martin Prpič 2015-05-14 14:17:00 UTC

Not vulnerable. This issue did not affect the versions of stunnel as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Note You need to log in before you can comment on or make changes to this bug.