Source: coturn Version: 4.12.0-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for coturn. CVE-2026-53449[0]: | Coturn is a free open source implementation of TURN and STUN Server. | Prior to 4.13.0, the psd print sessions dump CLI command in coturn | takes a filename argument and directly passes it to fopen with no | path validation. An authenticated admin with CLI access can | overwrite arbitrary files writable by the coturn process because the | command string is used as-is after stripping the psd prefix and | leading spaces, allowing truncation and overwrite with session dump | data. This issue is fixed in version 4.13.0. CVE-2026-53450[1]: | Coturn is a free open source implementation of TURN and STUN Server. | Prior to 4.13.0, coturn rejects loopback peers by default unless | allow-loopback-peers is enabled, but the default loopback guard can | be bypassed by using the IPv4-mapped IPv6 peer address | ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. | ioa_addr_is_loopback checks for the literal IPv6 loopback shape | before IPv4-mapped IPv6 handling, so good_peer_addr does not apply | the default loopback rejection and an authenticated TURN client can | expose services bound only to localhost on the coturn host through | TURN relay traffic. This issue is fixed in version 4.13.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-53449 https://www.cve.org/CVERecord?id=CVE-2026-53449 [1] https://security-tracker.debian.org/tracker/CVE-2026-53450 https://www.cve.org/CVERecord?id=CVE-2026-53450 Regards, Salvatore
