Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard c…
High CVSS 7.4
Summary
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754 Patch
- https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 Third Party Advisory
- https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 Third Party Advisory
Timeline
- nvd_ingest NVD