Read the docs
TI-2008-02320 Aliases CVE-2008-2420GHSA-7266-wh6x-6jjw

The OCSP functionality in stunnel before 4.24 does not properly search certificate…

Priority LOW 33CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.

Why it matters now

EPSS 0.01364 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:stunnel:stunnel:3.4a:*:*:*:*:*:*:*3.4aVulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.5:*:*:*:*:*:*:*3.5VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.6:*:*:*:*:*:*:*3.6VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.7:*:*:*:*:*:*:*3.7VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.8:*:*:*:*:*:*:*3.8VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.8p1:*:*:*:*:*:*:*3.8p1VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.8p2:*:*:*:*:*:*:*3.8p2VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.8p3:*:*:*:*:*:*:*3.8p3VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.8p4:*:*:*:*:*:*:*3.8p4VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.9:*:*:*:*:*:*:*3.9VulnerableStunnel
  • cpe:2.3:a:stunnel:stunnel:3.4a:*:*:*:*:*:*:* Versions 3.4a Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.7:*:*:*:*:*:*:* Versions 3.7 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.8p1:*:*:*:*:*:*:* Versions 3.8p1 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.8p2:*:*:*:*:*:*:* Versions 3.8p2 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.8p3:*:*:*:*:*:*:* Versions 3.8p3 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.8p4:*:*:*:*:*:*:* Versions 3.8p4 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.9:*:*:*:*:*:*:* Versions 3.9 Vulnerable ·Stunnel
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:stunnel:stunnel:3.10:*:*:*:*:*:*:*3.10VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.11:*:*:*:*:*:*:*3.11VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.12:*:*:*:*:*:*:*3.12VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.13:*:*:*:*:*:*:*3.13VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.14:*:*:*:*:*:*:*3.14VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.15:*:*:*:*:*:*:*3.15VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.16:*:*:*:*:*:*:*3.16VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.17:*:*:*:*:*:*:*3.17VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.18:*:*:*:*:*:*:*3.18VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.19:*:*:*:*:*:*:*3.19VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.20:*:*:*:*:*:*:*3.20VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.21:*:*:*:*:*:*:*3.21VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.21a:*:*:*:*:*:*:*3.21aVulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.21b:*:*:*:*:*:*:*3.21bVulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.21c:*:*:*:*:*:*:*3.21cVulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.22:*:*:*:*:*:*:*3.22VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.23:*:*:*:*:*:*:*3.23VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.24:*:*:*:*:*:*:*3.24VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.25:*:*:*:*:*:*:*3.25VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:3.26:*:*:*:*:*:*:*3.26VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.00:*:*:*:*:*:*:*4.00VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.01:*:*:*:*:*:*:*4.01VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.02:*:*:*:*:*:*:*4.02VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.03:*:*:*:*:*:*:*4.03VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.04:*:*:*:*:*:*:*4.04VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.05:*:*:*:*:*:*:*4.05VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.06:*:*:*:*:*:*:*4.06VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.07:*:*:*:*:*:*:*4.07VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.08:*:*:*:*:*:*:*4.08VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.09:*:*:*:*:*:*:*4.09VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.10:*:*:*:*:*:*:*4.10VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.11:*:*:*:*:*:*:*4.11VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.12:*:*:*:*:*:*:*4.12VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.13:*:*:*:*:*:*:*4.13VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.14:*:*:*:*:*:*:*4.14VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.15:*:*:*:*:*:*:*4.15VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.16:*:*:*:*:*:*:*4.16VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.17:*:*:*:*:*:*:*4.17VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.18:*:*:*:*:*:*:*4.18VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.19:*:*:*:*:*:*:*4.19VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.20:*:*:*:*:*:*:*4.20VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.21:*:*:*:*:*:*:*4.21VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.22:*:*:*:*:*:*:*4.22VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.23:*:*:*:*:*:*:*4.23VulnerableStunnel
  • cpe:2.3:a:stunnel:stunnel:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.12:*:*:*:*:*:*:* Versions 3.12 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.13:*:*:*:*:*:*:* Versions 3.13 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.14:*:*:*:*:*:*:* Versions 3.14 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.15:*:*:*:*:*:*:* Versions 3.15 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.16:*:*:*:*:*:*:* Versions 3.16 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.17:*:*:*:*:*:*:* Versions 3.17 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.18:*:*:*:*:*:*:* Versions 3.18 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.19:*:*:*:*:*:*:* Versions 3.19 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.20:*:*:*:*:*:*:* Versions 3.20 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.21:*:*:*:*:*:*:* Versions 3.21 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.21a:*:*:*:*:*:*:* Versions 3.21a Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.21b:*:*:*:*:*:*:* Versions 3.21b Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.21c:*:*:*:*:*:*:* Versions 3.21c Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.22:*:*:*:*:*:*:* Versions 3.22 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.23:*:*:*:*:*:*:* Versions 3.23 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.24:*:*:*:*:*:*:* Versions 3.24 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.25:*:*:*:*:*:*:* Versions 3.25 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:3.26:*:*:*:*:*:*:* Versions 3.26 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.00:*:*:*:*:*:*:* Versions 4.00 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.01:*:*:*:*:*:*:* Versions 4.01 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.02:*:*:*:*:*:*:* Versions 4.02 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.03:*:*:*:*:*:*:* Versions 4.03 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.04:*:*:*:*:*:*:* Versions 4.04 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.05:*:*:*:*:*:*:* Versions 4.05 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.06:*:*:*:*:*:*:* Versions 4.06 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.07:*:*:*:*:*:*:* Versions 4.07 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.08:*:*:*:*:*:*:* Versions 4.08 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.09:*:*:*:*:*:*:* Versions 4.09 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.13:*:*:*:*:*:*:* Versions 4.13 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.16:*:*:*:*:*:*:* Versions 4.16 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.17:*:*:*:*:*:*:* Versions 4.17 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.18:*:*:*:*:*:*:* Versions 4.18 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.19:*:*:*:*:*:*:* Versions 4.19 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Stunnel

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2420
  2. 2026-10-03 Alias added: GHSA-7266-wh6x-6jjw

References

Advisory 5

Other 2

  • TI-2011-02592 stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a… CVSS 2.0HIGH 9.3
  • TI-2001-00060 Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute… CVSS 2.0HIGH 10.0
  • TI-2002-00002 Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp… CVSS 2.0HIGH 7.5
  • TI-2021-03525 Improper certificate validation in stunnel CVSS 3.1HIGH 7.5
  • TI-2013-01549 stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are… CVSS 2.0MEDIUM 6.6
  • TI-2003-00142 OpenSSL does not use RSA blinding by default, which allows local and remote attackers to… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences