VDB
CVE-2020-4067
CVE-2020-4067
PUBLISHED
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
EPSS 0.87% · 75.5th percentile
Risk Scores
EPSS Score
0.87%
75.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | coturn | 0, 4.5.1.1-1.1build2, 4.5.1.1-1.1build1 |
| Ubuntu:16.04:LTS | coturn | 4.4.5.4-2, 4.5.0.2-3, 4.5.0.3-1 |
| Ubuntu:18.04:LTS | coturn | 4.5.0.7-1ubuntu2.18.04.1, 4.5.0.7-1ubuntu2, 4.5.0.7-1ubuntu1 |
Timeline
- Jun 29, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 22, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 25, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 27, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 2, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-4067 third-party-advisory
- https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm third-party-advisory
- https://github.com/coturn/coturn/commit/170da1140797748ae85565b5a93a2e35e7b07b6a third-party-advisory
- https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15 third-party-advisory
- https://github.com/coturn/coturn/issues/583 third-party-advisory
- https://www.debian.org/security/2020/dsa-4711 third-party-advisory
- https://ubuntu.com/security/notices/USN-4415-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-4067 third-party-advisory