Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard c…
高危 CVSS 7.4
摘要
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN…
中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754 Patch
- https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 Third Party Advisory
- https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 Third Party Advisory
时间线
- nvd_ingest NVD