CVE-2020-4067

Опубликовано: 29 июн. 2020

Источник: nvd

CVSS3: 7

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
Mailing List
Third Party Advisory
https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
Release Notes
https://github.com/coturn/coturn/issues/583
Issue Tracking
Third Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
https://usn.ubuntu.com/4415-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4711
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
Mailing List
Third Party Advisory
https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
Release Notes
https://github.com/coturn/coturn/issues/583
Issue Tracking
Third Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
https://usn.ubuntu.com/4415-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4711
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*

Версия до 4.5.1.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 5

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01104

Низкий

7 High

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-665

Связанные уязвимости

CVE-2020-4067

CVSS3: 7

ubuntu

больше 5 лет назад

CVE-2020-4067

CVSS3: 7

debian

больше 5 лет назад

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN ...

openSUSE-SU-2020:0937-1

suse-cvrf

больше 5 лет назад

Security update for coturn

BDU:2020-03981

CVSS3: 7.5

fstec

больше 5 лет назад

Уязвимость буфера ответа STUN/TURN веб-сервера Coturn, позволяющая нарушителю получить доступ к конфиденциальным данным

EPSS

Процентиль: 78%

0.01104

Низкий

7 High

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-665