CVE-2020-4067 - Improper Initialization in coturn

Back Back to CVE browser

HIGH

Improper Initialization in coturn

Published Jun 29, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.90%

Description

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.

Affected products

Vendor Coturn Product Coturn Default
n/a
- Version
  >= 5.1.1, < 6.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Coturn

n/a

Version	Status	Constraints
>= 5.1.1, < 6.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-665

References (9)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
x_refsource_MISCRelease Notes
https://github.com/coturn/coturn/issues/583
x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
x_refsource_CONFIRMThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
vendor-advisoryx_refsource_FEDORA
https://usn.ubuntu.com/4415-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.debian.org/security/2020/dsa-4711
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15		x_refsource_MISCRelease Notes
https://github.com/coturn/coturn/issues/583		x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm		x_refsource_CONFIRMThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/		vendor-advisoryx_refsource_FEDORA
https://usn.ubuntu.com/4415-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.debian.org/security/2020/dsa-4711		vendor-advisoryx_refsource_DEBIANThird Party Advisory