crítica
CVE-2020-6061
An exploitable heap out-of-bounds read vulnerability exists in the way ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | coturn | 4.5.1.1-1.1+deb10u1 |
| debian 11 | coturn | 4.5.1.1-1.2 |
| debian 12 | coturn | 4.5.1.1-1.2 |
| debian 13 | coturn | 4.5.1.1-1.2 |
| debian 14 | coturn | 4.5.1.1-1.2 |
| debian 9 | coturn | 4.5.0.5-1+deb9u2 |
| echo | coturn | 4.5.1.1-1.2 |
| ubuntu 16.04 | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 16.04-ESM | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 18.04 | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 18.04-ESM | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 19.10 | coturn | 4.5.1.1-1.1ubuntu0.19.10.1 |
Mostrar las 14 entradas de 14 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | coturn | 4.5.1.1-1.1+deb10u1 |
| debian 11 | coturn | 4.5.1.1-1.2 |
| debian 12 | coturn | 4.5.1.1-1.2 |
| debian 13 | coturn | 4.5.1.1-1.2 |
| debian 14 | coturn | 4.5.1.1-1.2 |
| debian 9 | coturn | 4.5.0.5-1+deb9u2 |
| echo | coturn | 4.5.1.1-1.2 |
| ubuntu 16.04 | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 16.04-ESM | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 18.04 | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 18.04-ESM | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 19.10 | coturn | 4.5.1.1-1.1ubuntu0.19.10.1 |
| ubuntu 20.04 | coturn | 4.5.1.1-1.1ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | coturn | 4.5.1.1-1.1ubuntu0.20.04.1 |
Referencias
- https://github.com/coturn/coturn/commit/51a7c2b9bf924890c7a3ff4db9c4976c5a93340a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQZZPI34LAS3SFNW6Z2ZJ46RKVGEODNA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUVZRXW5ZIGWVKOLF3NPXRPP74YX7BUY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XN2NK6FT7AMW5UIZNXDNHKEAYWAUMGSF/
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-0984
- https://ubuntu.com/security/notices/USN-4415-1
- https://usn.ubuntu.com/4415-1/
- https://www.cve.org/CVERecord?id=CVE-2020-6061