The following flaw was found in stunnel: Normally, clients are connected to the host(s) specified with the "connect" option on authentication success, and rejected on authentication failure (untrusted client certificate). When the "redirect" option is specified, such connections are supposed to be forwarded to the host(s) specified with "redirect" rather then rejected. In Stunnel versions 5.00 to 5.13, only the initial connection is redirected to the host(s) specified with "redirect". The subsequent connections established with reused SSL/TLS sessions are always forwarded to the host(s) specified with "connect" as if they were successfully authenticated. The vulnerability is exploitable under the following conditions: - Stunnel versions 5.00 to 5.13 inclusive. - Server mode mode is enabled with "client = no" (which is the default). - Certificate-based authentication is enabled with "verify = 2" or higher. - The "redirect" option is used. Upstream advisory: https://www.stunnel.org/CVE-2015-3644.html
Created stunnel tracking bugs for this issue: Affects: fedora-all [bug 1221674]
Statement: Not vulnerable. This issue did not affect the versions of stunnel as shipped with Red Hat Enterprise Linux 5, 6, and 7.