4.3

CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Stunnel ≫ Stunnel Version <= 4.56
Stunnel ≫ Stunnel Version0.1
Stunnel ≫ Stunnel Version1.0
Stunnel ≫ Stunnel Version1.1
Stunnel ≫ Stunnel Version1.2
Stunnel ≫ Stunnel Version1.3
Stunnel ≫ Stunnel Version1.4
Stunnel ≫ Stunnel Version1.5
Stunnel ≫ Stunnel Version1.6
Stunnel ≫ Stunnel Version2.0
Stunnel ≫ Stunnel Version2.1
Stunnel ≫ Stunnel Version3.0
Stunnel ≫ Stunnel Version3.0 Updateb1
Stunnel ≫ Stunnel Version3.0 Updateb2
Stunnel ≫ Stunnel Version3.0 Updateb3
Stunnel ≫ Stunnel Version3.0 Updateb4
Stunnel ≫ Stunnel Version3.0 Updateb5
Stunnel ≫ Stunnel Version3.0 Updateb6
Stunnel ≫ Stunnel Version3.0 Updateb7
Stunnel ≫ Stunnel Version3.1
Stunnel ≫ Stunnel Version3.2
Stunnel ≫ Stunnel Version3.3
Stunnel ≫ Stunnel Version3.4a
Stunnel ≫ Stunnel Version3.5
Stunnel ≫ Stunnel Version3.6
Stunnel ≫ Stunnel Version3.7
Stunnel ≫ Stunnel Version3.8
Stunnel ≫ Stunnel Version3.8 Updatep1
Stunnel ≫ Stunnel Version3.8 Updatep2
Stunnel ≫ Stunnel Version3.8 Updatep3
Stunnel ≫ Stunnel Version3.8 Updatep4
Stunnel ≫ Stunnel Version3.8p1
Stunnel ≫ Stunnel Version3.8p2
Stunnel ≫ Stunnel Version3.8p3
Stunnel ≫ Stunnel Version3.8p4
Stunnel ≫ Stunnel Version3.9
Stunnel ≫ Stunnel Version3.10
Stunnel ≫ Stunnel Version3.11
Stunnel ≫ Stunnel Version3.12
Stunnel ≫ Stunnel Version3.13
Stunnel ≫ Stunnel Version3.14
Stunnel ≫ Stunnel Version3.15
Stunnel ≫ Stunnel Version3.16
Stunnel ≫ Stunnel Version3.17
Stunnel ≫ Stunnel Version3.18
Stunnel ≫ Stunnel Version3.19
Stunnel ≫ Stunnel Version3.20
Stunnel ≫ Stunnel Version3.21
Stunnel ≫ Stunnel Version3.21a
Stunnel ≫ Stunnel Version3.21b
Stunnel ≫ Stunnel Version3.21c
Stunnel ≫ Stunnel Version3.22
Stunnel ≫ Stunnel Version3.23
Stunnel ≫ Stunnel Version3.24
Stunnel ≫ Stunnel Version3.25
Stunnel ≫ Stunnel Version3.26
Stunnel ≫ Stunnel Version4.00
Stunnel ≫ Stunnel Version4.0
Stunnel ≫ Stunnel Version4.01
Stunnel ≫ Stunnel Version4.02
Stunnel ≫ Stunnel Version4.03
Stunnel ≫ Stunnel Version4.04
Stunnel ≫ Stunnel Version4.05
Stunnel ≫ Stunnel Version4.06
Stunnel ≫ Stunnel Version4.07
Stunnel ≫ Stunnel Version4.08
Stunnel ≫ Stunnel Version4.09
Stunnel ≫ Stunnel Version4.10
Stunnel ≫ Stunnel Version4.11
Stunnel ≫ Stunnel Version4.12
Stunnel ≫ Stunnel Version4.13
Stunnel ≫ Stunnel Version4.14
Stunnel ≫ Stunnel Version4.15
Stunnel ≫ Stunnel Version4.16
Stunnel ≫ Stunnel Version4.17
Stunnel ≫ Stunnel Version4.18
Stunnel ≫ Stunnel Version4.19
Stunnel ≫ Stunnel Version4.20
Stunnel ≫ Stunnel Version4.21
Stunnel ≫ Stunnel Version4.22
Stunnel ≫ Stunnel Version4.23
Stunnel ≫ Stunnel Version4.24
Stunnel ≫ Stunnel Version4.25
Stunnel ≫ Stunnel Version4.26
Stunnel ≫ Stunnel Version4.27
Stunnel ≫ Stunnel Version4.28
Stunnel ≫ Stunnel Version4.29
Stunnel ≫ Stunnel Version4.30
Stunnel ≫ Stunnel Version4.31
Stunnel ≫ Stunnel Version4.32
Stunnel ≫ Stunnel Version4.33
Stunnel ≫ Stunnel Version4.34
Stunnel ≫ Stunnel Version4.35
Stunnel ≫ Stunnel Version4.36
Stunnel ≫ Stunnel Version4.37
Stunnel ≫ Stunnel Version4.38
Stunnel ≫ Stunnel Version4.39
Stunnel ≫ Stunnel Version4.40
Stunnel ≫ Stunnel Version4.41
Stunnel ≫ Stunnel Version4.42
Stunnel ≫ Stunnel Version4.43
Stunnel ≫ Stunnel Version4.44
Stunnel ≫ Stunnel Version4.45
Stunnel ≫ Stunnel Version4.46
Stunnel ≫ Stunnel Version4.47
Stunnel ≫ Stunnel Version4.48
Stunnel ≫ Stunnel Version4.49
Stunnel ≫ Stunnel Version4.50
Stunnel ≫ Stunnel Version4.51
Stunnel ≫ Stunnel Version4.52
Stunnel ≫ Stunnel Version4.53
Stunnel ≫ Stunnel Version4.54
Stunnel ≫ Stunnel Version4.55
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.513
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-332 Insufficient Entropy in PRNG

The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.

http://www.securityfocus.com/bid/65964
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1072180
Third Party Advisory
VDB Entry
Issue Tracking
https://www.stunnel.org/sdf_ChangeLog.html
Vendor Advisory
Release Notes