{"id":"CVE-2020-4067","aliases":["ALPINE-CVE-2020-4067","DEBIAN-CVE-2020-4067","DLA-2271-1","DSA-4711-1","EUVD-2020-25319","GHSA-c8r8-8vp5-6gcm","MGASA-2020-0287","UBUNTU-CVE-2020-4067","USN-4415-1","openSUSE-SU-2020:0937-1","openSUSE-SU-2024:10696-1"],"status":"published","title":"Improper Initialization in coturn","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01883,"percentile":0.79654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665"],"published":"2020-06-29T00:00:00Z","modified":"2026-11-03T06:32:37Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"coturn","fixed_in":["4.5.1.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"coturn","fixed_in":["4.5.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"coturn","fixed_in":["4.5.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"coturn","fixed_in":["4.5.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"coturn","fixed_in":["4.2.1.2-1+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"coturn","fixed_in":["4.5.0.7-2.4.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"coturn","fixed_in":["4.5.0.3-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"coturn","fixed_in":["4.5.0.7-1ubuntu2.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"coturn","fixed_in":["4.5.1.1-1.1ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"coturn","fixed_in":["4.5.1.3-lp152.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1.2-1+deb8u2"}]}],"versions":["4.2.1.2-1","4.2.1.2-1+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.5-1+deb9u2"}]}],"versions":["4.5.0.5-1","4.5.0.5-1+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1+deb10u1"}]}],"versions":["4.5.1.1-1.1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.7-2.4.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.3-1ubuntu0.3"}]}],"versions":["4.4.5.4-2","4.5.0.2-3","4.5.0.3-1","4.5.0.3-1build1","4.5.0.3-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.7-1ubuntu2.18.04.2"}]}],"versions":["4.5.0.6-1ubuntu2","4.5.0.7-1ubuntu1","4.5.0.7-1ubuntu2","4.5.0.7-1ubuntu2.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1ubuntu0.20.04.1"}]}],"versions":["4.5.1.1-1.1build1","4.5.1.1-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.3-1ubuntu0.3"}]}],"versions":["4.4.5.4-2","4.5.0.2-3","4.5.0.3-1","4.5.0.3-1build1","4.5.0.3-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0.7-1ubuntu2.18.04.2"}]}],"versions":["4.5.0.6-1ubuntu2","4.5.0.7-1ubuntu1","4.5.0.7-1ubuntu2","4.5.0.7-1ubuntu2.18.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.1-1.1ubuntu0.20.04.1"}]}],"versions":["4.5.1.1-1.1build1","4.5.1.1-1.1build2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1.3-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coturn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-2.2"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"coturn","product":"coturn"},{"vendor":"coturn_project","product":"coturn"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/coturn/coturn/issues/583","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15","tags":["x_refsource_MISC","x_transferred","Release Notes","advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4711","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4415-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-4067","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-4067","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0287.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-4067","tags":["report"]},{"url":"https://github.com/coturn/coturn/commit/170da1140797748ae85565b5a93a2e35e7b07b6a","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4415-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-4067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6062","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KSEKBPGO2SMOAK5MFJM27REZGSIHH6QK/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173510","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-4067","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6061","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-4067","title":"Improper Initialization in coturn","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T19:55:13Z","modified":"2024-08-04T07:52:20.848Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:35:55.797746Z"}],"euvd":[{"id":"EUVD-2020-25319","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T19:55:13Z","modified":"2024-08-04T07:52:20Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:08:07.872525Z"}],"nvd":[{"id":"CVE-2020-4067","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T20:15:10.413Z","modified":"2026-06-17T03:19:30.783Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ALPINE-CVE-2020-4067","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T20:15:10.413Z","modified":"2026-11-03T06:32:37.41762862Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"CVE-2020-4067","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T20:15:10.413Z","modified":"2026-10-20T10:54:21.841272286Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-4067","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T20:15:10.413Z","modified":"2026-10-26T12:02:49.545171411Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-4067","description":"In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.","status":"published","published":"2020-06-29T20:15:00Z","modified":"2026-02-04T04:26:54.926896Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DLA-2271-1","title":"coturn - security update","status":"published","published":"2020-07-01T00:00:00Z","modified":"2026-03-09T01:23:20.679127Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4711-1","title":"coturn - security update","status":"published","published":"2020-06-29T00:00:00Z","modified":"2026-03-09T02:10:01.048251Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0287","title":"Updated coturn packages fix security vulnerability","description":"The updated package fixes a security vulnerability:\n\nIn coturn before version 4.5.1.3, there is an issue whereby STUN/TURN\nresponse buffer is not initialized properly. There is a leak of\ninformation between different client connections. One client (an attacker)\ncould use their connection to intelligently query coturn to get interesting\nbytes in the padding bytes from the connection of another client.\n(CVE-2020-4067)\n","status":"published","published":"2020-07-10T08:01:08Z","modified":"2026-04-16T04:42:35.304248916Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0937-1","title":"Security update for coturn","description":"This update for coturn fixes the following issues:\n\nVersion 4.5.1.3:\n\n* Remove reference to SSLv3: gh#coturn/coturn#566\n* Ignore MD5 for BoringSSL: gh#coturn/coturn#579\n* STUN response buffer not initialized properly; he issue found and \n  reported gh#coturn/coturn#583 by Felix D�rre all credits belongs to \n  him. CVE-2020-4067, boo#1173510\n- Let coturn allow binding to ports below 1024 per default\n","status":"published","published":"2020-07-06T22:28:40Z","modified":"2026-02-04T04:10:13.111402Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10696-1","title":"coturn-4.5.2-2.2 on GA media","description":"These are all security issues fixed in the coturn-4.5.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:21.994588Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4415-1","title":"coturn vulnerabilities","description":"Felix Dörre discovered that coTURN response buffer is not initialized properly.\nAn attacker could possibly use this issue to obtain sensitive information.\n(CVE-2020-4067)\n\nIt was discovered that coTURN web server incorrectly handled HTTP POST requests.\nAn attacker could possibly use this issue to cause a denial of service, obtain\nsensitive information or other unspecified impact.\n(CVE-2020-6061, CVE-2020-6062)\n","status":"published","published":"2020-07-06T17:11:29Z","modified":"2026-02-10T04:41:52Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}