CVE-2020-4067
Improper Initialization in coturn
- State
- Published
- Severity
- 7.0 High
- Published
- Jun 29, 2020
- Updated
- Aug 4, 2024
- Reserved
- Dec 30, 2019
Description
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.0 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L | GitHub_M |
Weaknesses
- CWE-665 Improper Initialization
Affected Products
| Product | Versions |
|---|---|
coturncoturn |
|
References
- https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
- https://github.com/coturn/coturn/issues/583
- https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
- DSA-4711vendor-advisory
- [debian-lts-announce] 20200701 [SECURITY] [DLA 2271-1] coturn security updatemailing-list
- openSUSE-SU-2020:0937vendor-advisory
- USN-4415-1vendor-advisory
- FEDORA-2020-9eadf517devendor-advisory
- FEDORA-2020-d946f64eeavendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.