Source: coturn Version: 4.6.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for coturn. CVE-2026-27624[0]: | Coturn is a free open source implementation of TURN and STUN Server. | Coturn is commonly configured to block loopback and internal ranges | using "denied-peer-ip" and/or default loopback restrictions. | CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and | "[::]", but IPv4-mapped IPv6 is not covered. When sending a | "CreatePermission" or "ChannelBind" request with the "XOR-PEER- | ADDRESS" value of "::ffff:127.0.0.1", a successful response is | received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". | The root cause is that, prior to the updated fix implemented in | version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do | not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks | "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not | "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", | but not "::ffff:0.0.0.0." "addr_less_eq()" used by | "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range | is AF_INET and the peer is AF_INET6, the comparison returns 0 | without extracting the embedded IPv4. Version 4.9.0 contains an | updated fix to address the bypass of the fix for CVE-2020-26262. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-27624 https://www.cve.org/CVERecord?id=CVE-2026-27624 [1] https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjg [2] https://github.com/coturn/coturn/commit/b80eb898ba26552600770162c26a8ae7f3661b0b Please adjust the affected versions in the BTS as needed. Regards, Salvatore
