ISOMAN

CVE

CVE-2020-4067

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.

Severity
HIGH
CVSS
7
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu20.04.6 amd64 desktopunknownsource
Ubuntu20.04.6 amd64 live-serverunknownsource
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
  2. https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
  3. https://github.com/coturn/coturn/issues/583
  4. https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
  5. https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
  6. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
  7. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
  8. https://usn.ubuntu.com/4415-1/
  9. https://www.debian.org/security/2020/dsa-4711
  10. http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
  11. https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
  12. https://github.com/coturn/coturn/issues/583
  13. https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
  14. https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
  15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
  16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
  17. https://usn.ubuntu.com/4415-1/
  18. https://www.debian.org/security/2020/dsa-4711