CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes…

published March 23, 2014

CVSS
—
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02155 · 82.0th percentile
Published
2014-03-23T15:00Z
EPSS history
Timeline
  • 23 MAR 15:00Z
    stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes…
    cvelistv5