CVE-2008-2420 | BDVDB-2026-30794 Detail
Description#
The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by using revoked certificates.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://secunia.com/advisories/30425
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42528
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00942.html
- http://www.vupen.com/english/advisories/2008/1569/references
- http://secunia.com/advisories/30335
- http://secunia.com/advisories/31438
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00856.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:168
- http://stunnel.mirt.net/pipermail/stunnel-announce/2008-May/000035.html
- https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00907.html
- http://security.gentoo.org/glsa/glsa-200808-08.xml
- http://www.securityfocus.com/bid/29309
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.