UbuntuUpdates.org

Package "coturn"

Name: coturn

Description:

TURN and STUN server for VoIP
Latest version: 4.5.0.7-1ubuntu2.18.04.3
Release: bionic (18.04)
Level: updates
Repository: universe
Homepage: https://github.com/coturn/coturn/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "coturn"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "coturn" in Bionic

Repository Area Version
base universe 4.5.0.7-1ubuntu2
security universe 4.5.0.7-1ubuntu2.18.04.3

Changelog

Version: 4.5.0.7-1ubuntu2.18.04.3 2021-01-11 16:06:17 UTC

  coturn (4.5.0.7-1ubuntu2.18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Unsafe loopback interface
    - debian/patches/CVE-2020-26262.patch: Add check if address is in
      0.0.0.0/8 or ::/128.
    - CVE-2020-26262

 -- Mészáros Mihály <email address hidden> Mon, 14 Dec 2020 14:50:15 +0100
Source diff to previous version

Version: 4.5.0.7-1ubuntu2.18.04.2 2020-07-06 20:06:33 UTC

  coturn (4.5.0.7-1ubuntu2.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Heap-buffer overflow in HTTP POST request
    - debian/patches/CVE-2020-6061.patch: Fix overflow
    - CVE-2020-6061
  * SECURITY UPDATE: DoS when parsing certain HTTP POST request
    - debian/patches/CVE-2020-6062.patch: Fix parsing of POST requests
    - CVE-2020-6062
  * SECURITY UPDATE: Information leak between different client connections
    - debian/patches/CVE-2020-4067.patch: initialize with zero any new or
      reused stun buffers
    - CVE-2020-4067

 -- Eduardo Barretto <email address hidden> Thu, 02 Jul 2020 12:49:53 -0300
Source diff to previous version
CVE-2020-6061 An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request ca
CVE-2020-6062 An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST reques
CVE-2020-4067 In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information bet

Version: 4.5.0.7-1ubuntu2.18.04.1 2019-02-14 22:06:30 UTC

  coturn (4.5.0.7-1ubuntu2.18.04.1) bionic-security; urgency=medium

  * [1328ae1] HotFix: for 3 Vulnerability.
    For more details see:
    - CVE-2018-4056 - coTURN Administrator Web Portal SQL injection vulnerability
    - CVE-2018-4058 - coTURN TURN server unsafe loopback forwarding default configuration vulnerability
    - CVE-2018-4059 - coTURN server unsafe telnet admin portal default configuration vulnerability
    These patches address hotfix the 3 CVE above.
    * Disable-Web-admin-interface-due-Security-Vulnerability.patch
    It disables hardcocded web admin interface until 4.5.1.0 where it will be fixed correctly.
    * Disable-loopback-peers-due-Vulnerability.patch
    Disable by default loopback-peer functionality.
    * empty-cli-password-not-allowed-disable-telnet-cli.patch
    Disable telnet cli if the cli-password is empty.

 -- Mészáros Mihály <email address hidden> Wed, 06 Feb 2019 14:56:38 +0100
CVE-2018-4056 An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a


About   -   Send Feedback to @ubuntu_updates