Stunnel Information for VU#104280

Multiple vulnerabilities in SSL/TLS implementations



Vendor Statement

Stunnel requires the OpenSSL libraries for compilation (POSIX) or OpenSSL DLLs for runtime operation (Windows). While Stunnel itself is not vulnerable, it's dependence on OpenSSL means that your installation likely is vulnerable.

If you compile from source, you need to install a non-vulnerable version of OpenSSL and recompile Stunnel.

If you use the compiled Windows DLLs from, you should download new versions which are not vulnerable. OpenSSL 0.9.7c DLLs are available at

No new version of Stunnel source or executable will be made available, because the problems are inside OpenSSL -- Stunnel itself does not have the vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References



The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.