CVE-2020-4067

Katalog CVE

CVSS 7.5 · High EPSS 1,9%

Kerentanan Improper Initialization pada coturn project coturn, debian linux +3 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.

Rincian

Terbit di NVD

29 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html mailing list · advisory pihak ketiga
• https://github.com/coturn/coturn/issues/583 issue tracking · advisory pihak ketiga
• https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html mailing list · advisory pihak ketiga
• https://usn.ubuntu.com/4415-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4711 advisory pihak ketiga
• https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15 release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6S...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJ...