critique
CVE-2020-6061
An exploitable heap out-of-bounds read vulnerability exists in the way ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 10 | coturn | 4.5.1.1-1.1+deb10u1 |
| debian 11 | coturn | 4.5.1.1-1.2 |
| debian 12 | coturn | 4.5.1.1-1.2 |
| debian 13 | coturn | 4.5.1.1-1.2 |
| debian 14 | coturn | 4.5.1.1-1.2 |
| debian 9 | coturn | 4.5.0.5-1+deb9u2 |
| echo | coturn | 4.5.1.1-1.2 |
| ubuntu 16.04 | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 16.04-ESM | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 18.04 | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 18.04-ESM | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 19.10 | coturn | 4.5.1.1-1.1ubuntu0.19.10.1 |
Afficher les 14 entrées de 14 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 10 | coturn | 4.5.1.1-1.1+deb10u1 |
| debian 11 | coturn | 4.5.1.1-1.2 |
| debian 12 | coturn | 4.5.1.1-1.2 |
| debian 13 | coturn | 4.5.1.1-1.2 |
| debian 14 | coturn | 4.5.1.1-1.2 |
| debian 9 | coturn | 4.5.0.5-1+deb9u2 |
| echo | coturn | 4.5.1.1-1.2 |
| ubuntu 16.04 | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 16.04-ESM | coturn | 4.5.0.3-1ubuntu0.3 |
| ubuntu 18.04 | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 18.04-ESM | coturn | 4.5.0.7-1ubuntu2.18.04.2 |
| ubuntu 19.10 | coturn | 4.5.1.1-1.1ubuntu0.19.10.1 |
| ubuntu 20.04 | coturn | 4.5.1.1-1.1ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | coturn | 4.5.1.1-1.1ubuntu0.20.04.1 |
Références
- https://github.com/coturn/coturn/commit/51a7c2b9bf924890c7a3ff4db9c4976c5a93340a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQZZPI34LAS3SFNW6Z2ZJ46RKVGEODNA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUVZRXW5ZIGWVKOLF3NPXRPP74YX7BUY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XN2NK6FT7AMW5UIZNXDNHKEAYWAUMGSF/
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-0984
- https://ubuntu.com/security/notices/USN-4415-1
- https://usn.ubuntu.com/4415-1/
- https://www.cve.org/CVERecord?id=CVE-2020-6061