---
title: "CVE-2014-0016\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2014-0016?format=md
keywords: index, follow
---

# CVE-2014-0016

Publication date 24 March 2014

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

stunnel before 5.00, when using fork threading, does not properly update
the state of the OpenSSL pseudo-random number generator (PRNG), which
causes subsequent children with the same process ID to use the same entropy
pool and allows remote attackers to obtain private keys for EC (ECDSA) or
DSA certificates.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2014-0016?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| stunnel4 | 18.04 LTS bionic | Fixed 3:5.02-1 |
| 17.10 artful | Fixed 3:5.02-1 |
| 17.04 zesty | Fixed 3:5.02-1 |
| 16.10 yakkety | Fixed 3:5.02-1 |
| 16.04 LTS xenial | Fixed 3:5.02-1 |
| 15.10 wily | Fixed 3:5.02-1 |
| 15.04 vivid | Fixed 3:5.02-1 |
| 14.10 utopic | Fixed 3:5.02-1 |
| 14.04 LTS trusty | Not affected |
| 13.10 saucy | Ignored end of life |
| 12.10 quantal | Ignored end of life |
| 12.04 LTS precise | Ignored end of life |
| 10.04 LTS lucid | Ignored end of life |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [ebarretto](https://launchpad.net/~ebarretto)

Not affected since deb package compiled with
--with-threads=pthread

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0016)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-0016)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-0016)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2014-0016)

### Other references

* <http://www.openwall.com/lists/oss-security/2014/03/05/1>
* <https://www.cve.org/CVERecord?id=CVE-2014-0016>