Attachment 216137 Details for Bug 247714 – vuxml patch to include coturn CVE-2020-4067

[patch] vuxml patch to include coturn CVE-2020-4067

coturn.diff (text/plain), 1.16 KB, created by rob2g2 on 2020-07-02 12:26:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: rob2g2

Created: 2020-07-02 12:26:16 UTC

Size: 1.16 KB

patch

obsolete

>--- vuln2.xml	Thu Jul  2 14:09:53 2020
>+++ vuln.xml	Thu Jul  2 14:23:11 2020
>@@ -60,0 +61,27 @@
>+  <vuln vid="fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea">
>+    <topic>coturn -- information leakage</topic>
>+    <affects>
>+      <package>
>+	<name>coturn</name>
>+	<range><lt>4.5.1.3</lt></range>
>+      </package>
>+    </affects>
>+    <description>
>+      <body xmlns="http://www.w3.org/1999/xhtml">
>+	<p>Felix Doerre reports:</p>
>+	<blockquote cite="https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm">
>+	  <p>The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665)
>+This is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client.</p>
>+	</blockquote>
>+      </body>
>+    </description>
>+    <references>
>+      <url>https://github.com/coturn/coturn/commit/fdf7065d0f8e676feaf6734e86370f6dadfb8eec</url>
>+      <cvename>CVE-2020-4067</cvename>
>+    </references>
>+    <dates>
>+      <discovery>2020-06-30</discovery>
>+      <entry>2020-07-02</entry>
>+    </dates>
>+  </vuln>
>+

Actions: View | Diff

Attachments on bug 247714: 216137