Summary
Felix Dörre discovered that coTURN response buffer is not initialized properly.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2020-4067)
It was discovered that coTURN web server incorrectly handled HTTP POST requests.
An attacker could possibly use this issue to cause a denial of service, obtain
sensitive information or other unspecified impact.
(CVE-2020-6061, CVE-2020-6062)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | coturn | 4.5.0.3-1ubuntu0.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | coturn | 4.5.1.1-1.1ubuntu0.20.04.1 |
Vulnerabilities 3
-
High 7.0
Improper Initialization in coturn
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query …
-
High 7.0
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. …
-
Medium 5.9
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A spec…