CVE-2018-4058: coturn_project coturn
Vulnerability summary
CVE-2018-4058 is a high (CVSS 7.7) vulnerability in coturn_project coturn. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 21-03-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- NVDNIST7.7HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.92% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Coturn_project1 product
- coturn< 4.5.0.9
Debian1 product
- coturn< 4.5.1.0-1
Talos1 product
- coturncoTURN 4.5.0.5
Ubuntu1 product
- coturn< 4.5.0.3-1ubuntu0.2 | < 4.5.0.7-1ubuntu2.18.04.1
4 vendors · 4 products
References
5 links- talosintelligence.com/vulnerability_reports/TALOS-2018-0732X Refsource MISCMitigationThird Party Advisory
