CVE-2014-0016 | BDVDB-2026-60568 Detail

Description#

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.stunnel.org/sdf_ChangeLog.html
https://bugzilla.redhat.com/attachment.cgi?id=870826&action=diff
http://www.openwall.com/lists/oss-security/2014/03/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=1072180
http://www.securityfocus.com/bid/65964

Exploit#

No public exploit known

History#

Version 12014-03-23Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.