CVE-2021-21382

Restund is an open source NAT traversal server. The restund TURN server can be instructed to open a relay to the loopback address range. This allows you to reach any other service running on localhost which you might consider private. In the configuration that we ship (https://github.com/wireapp/ansible-restund/blob/master/templates/restund.conf.j2#L40-L43) the status interface of restund is enabled and is listening on 127.0.0.1.The status interface allows users to issue administrative commands to restund like listing open relays or draining connections. It would be possible for an attacker to contact the status interface and issue administrative commands by setting XOR-PEER-ADDRESS to 127.0.0.1:{{restund_udp_status_port}} when opening a TURN channel. We now explicitly disallow relaying to loopback addresses, 'any' addresses, link local addresses, and the broadcast address. As a workaround disable the status module in your restund configuration. However there might still