Created attachment 272543 [details] patch to update turnserver to 4.14.0 This patch updates Coturn to the latest release 4.14.0. Multiple security fixes: CVE-2026-53450, CVE-2026-53449, CVE-2026-53448, CVE-2026-43915. Changelogs: https://github.com/coturn/coturn/blob/4.14.0/ChangeLog https://github.com/coturn/coturn/releases/tag/4.11.0 https://github.com/coturn/coturn/releases/tag/4.12.0 https://github.com/coturn/coturn/releases/tag/4.13.0 https://github.com/coturn/coturn/releases/tag/4.13.1 https://github.com/coturn/coturn/releases/tag/4.14.0 * QA successful: poudriere
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=fd77dbcdcf0659b6d458f06b1da69302cf76655e commit fd77dbcdcf0659b6d458f06b1da69302cf76655e Author: Frank Wall <freebsd@moov.de> AuthorDate: 2026-07-06 23:59:17 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-07-07 00:02:12 +0000 net/turnserver: Update 4.10.0 => 4.14.0 (fix 4 CVEs) Changelogs: https://github.com/coturn/coturn/blob/4.14.0/ChangeLog https://github.com/coturn/coturn/releases/tag/4.11.0 https://github.com/coturn/coturn/releases/tag/4.12.0 https://github.com/coturn/coturn/releases/tag/4.13.0 https://github.com/coturn/coturn/releases/tag/4.13.1 https://github.com/coturn/coturn/releases/tag/4.14.0 - Remove dead mirror from MASTER_SITES. - Switch from http to https in MASTER_SITES. - Remove unused dependency gettext-runtime. PR: 296555 Approved by: blanket (fix 4 CVEs) Security: CVE-2026-53450 Security: CVE-2026-53449 Security: CVE-2026-53448 Security: CVE-2026-43915 Sponsored by: UNIS Labs Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org> MFH: 2026Q2 net/turnserver/Makefile | 7 +++---- net/turnserver/distinfo | 6 +++--- 2 files changed, 6 insertions(+), 7 deletions(-)
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=0063585c20a87972d295a11a5c5126422ea8c6fa commit 0063585c20a87972d295a11a5c5126422ea8c6fa Author: Frank Wall <freebsd@moov.de> AuthorDate: 2026-07-06 23:59:17 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-07-07 00:03:51 +0000 net/turnserver: Update 4.10.0 => 4.14.0 (fix 4 CVEs) Changelogs: https://github.com/coturn/coturn/blob/4.14.0/ChangeLog https://github.com/coturn/coturn/releases/tag/4.11.0 https://github.com/coturn/coturn/releases/tag/4.12.0 https://github.com/coturn/coturn/releases/tag/4.13.0 https://github.com/coturn/coturn/releases/tag/4.13.1 https://github.com/coturn/coturn/releases/tag/4.14.0 - Remove dead mirror from MASTER_SITES. - Switch from http to https in MASTER_SITES. - Remove unused dependency gettext-runtime. PR: 296555 Approved by: blanket (fix 4 CVEs) Security: CVE-2026-53450 Security: CVE-2026-53449 Security: CVE-2026-53448 Security: CVE-2026-43915 Sponsored by: UNIS Labs Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org> MFH: 2026Q2 (cherry picked from commit fd77dbcdcf0659b6d458f06b1da69302cf76655e) net/turnserver/Makefile | 7 +++---- net/turnserver/distinfo | 6 +++--- 2 files changed, 6 insertions(+), 7 deletions(-)
Thanks.