Read the docs
TI-2013-01549 Aliases CVE-2013-1762GHSA-997q-cp6v-cm6w

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are…

Priority LOW 35CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.

Why it matters now

EPSS 0.02932 87th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:stunnel:stunnel:*:*:*:*:*:*:*:*up to 4.54VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.21:*:*:*:*:*:*:*4.21VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.22:*:*:*:*:*:*:*4.22VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.23:*:*:*:*:*:*:*4.23VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.24:*:*:*:*:*:*:*4.24VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.25:*:*:*:*:*:*:*4.25VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.26:*:*:*:*:*:*:*4.26VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.27:*:*:*:*:*:*:*4.27VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.28:*:*:*:*:*:*:*4.28VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.29:*:*:*:*:*:*:*4.29VulnerableStunnel
  • cpe:2.3:a:stunnel:stunnel:*:*:*:*:*:*:*:* Versions up to 4.54 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.27:*:*:*:*:*:*:* Versions 4.27 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.28:*:*:*:*:*:*:* Versions 4.28 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.29:*:*:*:*:*:*:* Versions 4.29 Vulnerable ·Stunnel
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:stunnel:stunnel:4.30:*:*:*:*:*:*:*4.30VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.31:*:*:*:*:*:*:*4.31VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.32:*:*:*:*:*:*:*4.32VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.33:*:*:*:*:*:*:*4.33VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.34:*:*:*:*:*:*:*4.34VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.35:*:*:*:*:*:*:*4.35VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.36:*:*:*:*:*:*:*4.36VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.37:*:*:*:*:*:*:*4.37VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.38:*:*:*:*:*:*:*4.38VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.39:*:*:*:*:*:*:*4.39VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.40:*:*:*:*:*:*:*4.40VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.41:*:*:*:*:*:*:*4.41VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.42:*:*:*:*:*:*:*4.42VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.43:*:*:*:*:*:*:*4.43VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.44:*:*:*:*:*:*:*4.44VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.45:*:*:*:*:*:*:*4.45VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.46:*:*:*:*:*:*:*4.46VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.47:*:*:*:*:*:*:*4.47VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.48:*:*:*:*:*:*:*4.48VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.49:*:*:*:*:*:*:*4.49VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.50:*:*:*:*:*:*:*4.50VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.51:*:*:*:*:*:*:*4.51VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.52:*:*:*:*:*:*:*4.52VulnerableStunnel
cpe:2.3:a:stunnel:stunnel:4.53:*:*:*:*:*:*:*4.53VulnerableStunnel
  • cpe:2.3:a:stunnel:stunnel:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.36:*:*:*:*:*:*:* Versions 4.36 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.37:*:*:*:*:*:*:* Versions 4.37 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.38:*:*:*:*:*:*:* Versions 4.38 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.39:*:*:*:*:*:*:* Versions 4.39 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.40:*:*:*:*:*:*:* Versions 4.40 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.41:*:*:*:*:*:*:* Versions 4.41 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.42:*:*:*:*:*:*:* Versions 4.42 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.43:*:*:*:*:*:*:* Versions 4.43 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.44:*:*:*:*:*:*:* Versions 4.44 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.45:*:*:*:*:*:*:* Versions 4.45 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.46:*:*:*:*:*:*:* Versions 4.46 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.47:*:*:*:*:*:*:* Versions 4.47 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.48:*:*:*:*:*:*:* Versions 4.48 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.49:*:*:*:*:*:*:* Versions 4.49 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.50:*:*:*:*:*:*:* Versions 4.50 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.51:*:*:*:*:*:*:* Versions 4.51 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.52:*:*:*:*:*:*:* Versions 4.52 Vulnerable ·Stunnel
  • cpe:2.3:a:stunnel:stunnel:4.53:*:*:*:*:*:*:* Versions 4.53 Vulnerable ·Stunnel

Remediation

Red Hat 1 advisory

  • RHSA-2013:0714 Released 2013-04-08 · Red Hat rating Moderate
    stunnel security update
    • Red Hat Enterprise Linux Desktop (v. 6) stunnel-4.29-3.el6_4
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) stunnel-4.29-3.el6_4
    • Red Hat Enterprise Linux Server (v. 6) stunnel-4.29-3.el6_4
    • Red Hat Enterprise Linux Workstation (v. 6) stunnel-4.29-3.el6_4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2013:0714
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2013:0714
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2013:0714
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2013:0714
Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1762
  2. 2026-10-03 Alias added: GHSA-997q-cp6v-cm6w

References

Advisory 4

Other 1

  • TI-2011-02592 stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a… CVSS 2.0HIGH 9.3
  • TI-2001-00060 Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute… CVSS 2.0HIGH 10.0
  • TI-2002-00002 Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp… CVSS 2.0HIGH 7.5
  • TI-2021-03525 Improper certificate validation in stunnel CVSS 3.1HIGH 7.5
  • TI-2008-02320 The OCSP functionality in stunnel before 4.24 does not properly search certificate… CVSS 2.0MEDIUM 6.8
  • TI-2003-00142 OpenSSL does not use RSA blinding by default, which allows local and remote attackers to… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences