CVE-2025-69217

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

These are all security issues fixed in the coturn-4.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for coturn fixes the following issues:

Changes in coturn:

• Update to version 4.14.0 New

  • No more dependency on prometheus-client-c
  • HTTPS support for prometheus client (optional)
  • TLS support for redis - now compatible with managed redis (optional).
  • Rate limiting "401 Unauthorized" responses - reduces reflection attacks off the coturn server. This is an experimental feature - not fully tested on production scale deployment and massive DDoS attacks. New prometheus counters should help shed some light on real life behavior and performance. The feature is off by default. What's Changed
  • validate hmackey length in sqlite_get_user_key before hex decode.
  • Add out-of-tree patch to restore deprecated OpenSSL 1.1.1.
  • Add optional TLS transport for Redis connections.
  • Fix relay threads override.
  • Flush prometheus hot-path counters once per second to kill lock contention.
  • fix signed-char index out-of-bounds read in base64_decode.
  • Build Prometheus exporter from vendored local sources.
  • Prom https.
  • Fix realm quota data race and warnings.
  • Add per-source rate-limiting of UDP 401 Unauthorized responses

• Update to version 4.13.1

  • null-terminate server_name in stun_is_challenge_response_str.
  • Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks.
  • Auto-deny coturn's own database backend endpoints as relay peers.
  • Deny link-local / ULA / site-local relay peers by default.

• Update to version 4.13.0

  • Wrap atomic everywhere.
  • Fix sendmmsg stride bug in multiplex-peer UDP batch flush.
  • Reap TURN permissions/channels via a per-thread sweep instead of per-object timers.
  • Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO batching.
  • Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics
  • Restrict recvmmsg fast path to shared fan-in sockets (make --udp-recvmmsg useful standalone).
  • Enable --udp-recvmmsg by default on Linux.
  • Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time compare, OAuth bounds checks, permission cap (#1932).
  • Add continuous latency mode to stunclient.
  • Fix test_redis_format link failure.
  • Fix configure MANPREFIX typo.
  • Fix missing sqlite3 dependendcy.
  • Fix UDP receive buffer ownership.

• Update to version 4.12.0

  • Update khash to the latest version (#1919).
  • Update readme to match latest changes (#1920).
  • Update docs for drop-invalid-packets and response-origin-only-with-rfc5780.
  • Multiplexpeer (#1916).
  • Fix TTL/TOS type conversion (#1915).
  • turnutils_uclient: sender thread pool + UDP-GSO send batching + recv_pps reporting (#1913).
  • Fix memory leak introduced by recvmmsg path (#1912).
  • turnutils_uclient: multi-threaded listener (recv) pool.
  • examples/turnserver.conf: update description of cli option.
  • turnutils_uclient: Linux recvmmsg receive path + larger SO_RCVBUF (#1910).
  • Add UDP-GSO send path (--udp-gso) (#1907).
  • turnutils_peer: Linux fast path with drain loop, recvmmsg/sendmmsg, U… (#1908).
  • Relay recvmmsg (#1906).
  • fuzzing: use hex escapes for HTTP EOH dictionary entry.
  • Sync turnserver man page with current CLI options (#1903).
  • Remove stale --ne option from turnserver --help (#1904).
  • Restore CodeQL permissions, category, and manual build mode.

• Update to version 4.11.0

  • Filc harness and pointer typedefs (#1896).
  • Load generator mode in turnutils_uclient (#1894).
  • Cache hot lookups in TURN data-path handlers (#1893).
  • Inline get_ioa_addr_len() in the header (#1891).
  • Trim two redundant checks from per-packet relay hot path.
  • Hoist turn_server_get_engine() out of per-packet hot path.
  • Add fuzz coverage for integrity helpers (#1888).
  • Add deterministic challenge-response builder to FuzzStun.
  • Seed address-mapping table in fuzz initializer (#1885).
  • Unblock fuzz coverage for…