Stay Secure with the Latest Linux Advisories

security advisorysecurity updatestunnel

Mageia 8: MGASA-2022-0109 Moderate: Stunnel Security Fix

Update to 5.62 including new features and bugfixes: Security bugfixes - The "redirect" option was fixed to properly handle unauthenticated requests (bsc#1182529). - Fixed a double free with OpenSSL older than 1.1.0. . MGASA-2022-0109 - Updated stunnel packages fix security vulnerability Publication date: 21 Mar 2022 URL: https://advisories.mageia.org/MGASA-2022-0109.html Type: security Affected Mageia releases: 8 Update to 5.62 including new features and bugfixes: Security bugfixes - The "redirect" option was fixed to properly handle unauthenticated requests (bsc#1182529). - Fixed a double free with OpenSSL older than 1.1.0. - Added hardening to systemd service (bsc#1181400). New features - Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options. - Added support for the new SSL_set_options() values. - Added a bash completion script. - New 'sessionResume' service-level option to allow or disallow session resumption - Download fresh ca-certs.pem for each new release. - New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers). - 'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value. - Initial FIPS 3.0 support. - Client-side "protocol = ldap" support Bugfixes - Fixed a transfer() loop bug. - Fixed reloading configuration with "systemctl reload stunnel.service". - Fixed incorrect messages logged for OpenSSL errors. - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates. - Fixed a tiny memory leak in configuration file reload error handling. - Fixed engine initialization. - FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available. - Fix configuration reload when compression is used -Fix test suite fixed not to require external connectivity References: - https://bugs.mageia.org/show_bug.cgi?id=30185 - https://lists.suse.com/pipermail/sle-security-updates/2022-March/010458.html - SRPMS: - 8/core/stunnel-5.63-1.mga8 . Debian 2022-0205 updates curl to address vulnerabilities and improve performance with added options and support for new standards.. Mageia Security, Stunnel Update, Bugfixes, Security Fix. . LinuxSecurity.com Team

Mar 21, 2022 Mageia