CVE catalog
CVE-2014-0016
stunnel4: CVE-2014-0016
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.15% · Oct 25, 2026
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | stunnel4 | trixie | 3:5.74-2 | not affected |
| Debian | stunnel4 | bookworm | 3:5.68-2+deb12u1 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | stunnel4 | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | stunnel4 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [stunnel4]Not affected
Details (2)
3:5.68-2+deb12u1· amd64 · bookwormNot affected
dsa · stunnel4 · debian · bookworm
3:5.68-2+deb12u1· arm64 · bookwormNot affected
dsa · stunnel4 · debian · bookworm
Observed: