cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/vuxml update: coturn CVE-2020-4067 for net/coturn

Browse Source
This commit is contained in:
Yuri Victorovich 2020-07-02 17:33:32 +00:00
parent 5167ba2bef
commit d29c828393
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=541049
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
security/vuxml/vuln.xml
View File

@ -58,6 +58,35 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea">
<topic>coturn -- information leakage</topic>
<affects>
<package>
<name>coturn</name>
<range><lt>4.5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felix Dörre reports:</p>
<blockquote cite="https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm">
<p>The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665)
This is a leak of information between different client connections. One client (an attacker)
could use their connection to intelligently query coturn to get interesting bytes in the
padding bytes from the connection of another client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/coturn/coturn/commit/fdf7065d0f8e676feaf6734e86370f6dadfb8eec</url>
<cvename>CVE-2020-4067</cvename>
</references>
<dates>
<discovery>2020-06-30</discovery>
<entry>2020-07-02</entry>
</dates>
</vuln>
<vuln vid="641cd669-bc37-11ea-babf-6805ca2fa271">
<topic>powerdns-recursor -- access restriction bypass</topic>
<affects>