CVE-2020-4067
Improper Initialization in coturn
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Improper Initialization in coturn
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
CVE-2020-4067- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-665
- Updated
- 2026-11-02
EUVDEUVD-2020-25319
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
EUVD-2020-25319- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-03
NVD
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
CVE-2020-4067- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-665
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-4067
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
ALPINE-CVE-2020-4067- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
CVE-2020-4067- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-4067
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
DEBIAN-CVE-2020-4067- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2020-4067
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
- Record
UBUNTU-CVE-2020-4067- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2020-0287 No score
Updated coturn packages fix security vulnerability
The updated package fixes a security vulnerability:
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. (CVE-2020-4067)
- Record
MGASA-2020-0287- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0937-1 No score
Security update for coturn
This update for coturn fixes the following issues:
Version 4.5.1.3:
- Remove reference to SSLv3: gh#coturn/coturn#566
- Ignore MD5 for BoringSSL: gh#coturn/coturn#579
- STUN response buffer not initialized properly; he issue found and reported gh#coturn/coturn#583 by Felix D�rre all credits belongs to him. CVE-2020-4067, boo#1173510
- Let coturn allow binding to ports below 1024 per default
- Record
openSUSE-SU-2020:0937-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10696-1 No score
coturn-4.5.2-2.2 on GA media
These are all security issues fixed in the coturn-4.5.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10696-1- Updated
- 2026-11-02
OSVUSN-4415-1 No score
coturn vulnerabilities
Felix Dörre discovered that coTURN response buffer is not initialized properly. An attacker could possibly use this issue to obtain sensitive information. (CVE-2020-4067)
It was discovered that coTURN web server incorrectly handled HTTP POST requests. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified impact. (CVE-2020-6061, CVE-2020-6062)
- Record
USN-4415-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
coturnAlpine:v3.12 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.13 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.14 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.15 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.16 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.17 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.18 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.19 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.20 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.21 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
coturnAlpine:v3.22 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.23 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnAlpine:v3.24 |
before 4.5.1.3-r0 | 4.5.1.3-r0 |
coturnDebian:12 |
before 4.5.1.3-1 | 4.5.1.3-1 |
coturnDebian:13 |
before 4.5.1.3-1 | 4.5.1.3-1 |
coturnDebian:14 |
before 4.5.1.3-1 | 4.5.1.3-1 |
coturnDebian:8 |
before 4.2.1.2-1+deb8u2, plus listed versions 4.2.1.2-14.2.1.2-1+deb8u1 |
4.2.1.2-1+deb8u2 |
coturnDebian:9 |
before 4.5.0.5-1+deb9u2, plus listed versions 4.5.0.5-14.5.0.5-1+deb9u1 |
4.5.0.5-1+deb9u2 |
coturnDebian:10 |
before 4.5.1.1-1.1+deb10u1, plus listed versions 4.5.1.1-1.1 |
4.5.1.1-1.1+deb10u1 |
coturnMageia:7 |
before 4.5.0.7-2.4.mga7 | 4.5.0.7-2.4.mga7 |
coturnUbuntu:16.04:LTS |
before 4.5.0.3-1ubuntu0.3, plus listed versions 4.4.5.4-24.5.0.2-34.5.0.3-14.5.0.3-1build14.5.0.3-1ubuntu0.2 |
4.5.0.3-1ubuntu0.3 |
coturnUbuntu:18.04:LTS |
before 4.5.0.7-1ubuntu2.18.04.2, plus listed versions 4.5.0.6-1ubuntu24.5.0.7-1ubuntu14.5.0.7-1ubuntu24.5.0.7-1ubuntu2.18.04.1 |
4.5.0.7-1ubuntu2.18.04.2 |
coturnUbuntu:20.04:LTS |
before 4.5.1.1-1.1ubuntu0.20.04.1, plus listed versions 4.5.1.1-1.1build14.5.1.1-1.1build2 |
4.5.1.1-1.1ubuntu0.20.04.1 |
coturnopenSUSE:Leap 15.2 |
before 4.5.1.3-lp152.2.3.1 | 4.5.1.3-lp152.2.3.1 |
coturnopenSUSE:Tumbleweed |
before 4.5.2-2.2 | 4.5.2-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-4067 is a high vulnerability (CVSS 7.0) in Coturn, published June 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in coturn 4.5.1.3-r0.
References
github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
debian.org/security/2020/dsa-4711
lists.debian.org/debian-lts-announce/2020/07/msg00002.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
Show 18 moreShow less
usn.ubuntu.com/4415-1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK
security.alpinelinux.org/vuln/CVE-2020-4067
security-tracker.debian.org/tracker/CVE-2020-4067
advisories.mageia.org/MGASA-2020-0287.html
bugs.mageia.org/show_bug.cgi?id=26879
ubuntu.com/security/CVE-2020-4067
cve.org/CVERecord?id=CVE-2020-4067
bugzilla.suse.com/1173510
suse.com/security/cve/CVE-2020-4067