Security update for stunnel SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0872-1 Final 1 1 2022-03-16T09:35:18Z current 2022-03-16T09:35:18Z 2022-03-16T09:35:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for stunnel This update for stunnel fixes the following issues: Update to 5.62 including new features and bugfixes: * Security bugfixes - The 'redirect' option was fixed to properly handle unauthenticated requests (bsc#1182529). - Fixed a double free with OpenSSL older than 1.1.0. - Added hardening to systemd service (bsc#1181400). * New features - Added new 'protocol = capwin' and 'protocol = capwinctrl' configuration file options. - Added support for the new SSL_set_options() values. - Added a bash completion script. - New 'sessionResume' service-level option to allow or disallow session resumption - Download fresh ca-certs.pem for each new release. - New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers). - 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value. - Initial FIPS 3.0 support. - Client-side 'protocol = ldap' support * Bugfixes - Fixed a transfer() loop bug. - Fixed reloading configuration with 'systemctl reload stunnel.service'. - Fixed incorrect messages logged for OpenSSL errors. - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates. - Fixed a tiny memory leak in configuration file reload error handling. - Fixed engine initialization. - FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available. - Fix configuration reload when compression is used - Fix test suite fixed not to require external connectivity The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-872,openSUSE-SLE-15.4-2022-872 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SF6GP7Y7QBDPSDEMYQPWKSOXKRHILQVP/ E-Mail link for openSUSE-SU-2022:0872-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1182529 SUSE Bug 1182529 openSUSE Leap 15.3 stunnel-5.62-3.14.1 stunnel-doc-5.62-3.14.1 stunnel-5.62-3.14.1 as a component of openSUSE Leap 15.3 stunnel-doc-5.62-3.14.1 as a component of openSUSE Leap 15.3