CVE-2020-4067: canonical ubuntu_linux Improper Initialization
Vulnerability summary
CVE-2020-4067 is a high (CVSS 7.5) Improper Initialization vulnerability in canonical ubuntu_linux. EPSS estimates a 1.90% chance of exploitation in the next 30 days, higher than 79.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 29-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA7.0HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.90%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.90% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- coturn< 4.5.1.3-1 | < 4.2.1.2-1+deb8u2
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse2 products
- leapEOL15.2
- coturn&distro=openSUSE Leap 15.2< 4.5.1.3-lp152.2.3.1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.10 | 20.04
Coturn1 product
- coturn≥ 5.1.1, < 6.0.0
Coturn_project1 product
- coturn< 4.5.1.3
Fedoraproject1 product
- fedoraEOL31 | 32
Mageia1 product
- coturn< 4.5.0.7-2.4.mga7
Ubuntu1 product
- coturn< 4.5.0.3-1ubuntu0.3 | < 4.5.0.7-1ubuntu2.18.04.2 | < 4.5.1.1-1.1ubuntu0.20.04.1
8 vendors · 10 products
References
19 links- github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcmX Refsource CONFIRMREPORTThird Party Advisory
- github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLogX Refsource MISCREPORTRelease Notes
- lists.debian.org/debian-lts-announce/2020/07/msg00002.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 19 references
- lists.opensuse.org/archives/…Advisory