Home

CVE-2020-6061

Description

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
1.772

Associated Vulnerability

VulnerabilityOS Platform
coturn security update(DSA-4711-1) coturn_4.5.0.5-1+deb9u2_i386.debLinux
coturn security update(DSA-4711-1) coturn_4.5.0.5-1+deb9u2_amd64.debLinux
coturn security update(DSA-4711-1) coturn_4.5.1.1-1.1+deb10u1_i386.debLinux
coturn security update(DSA-4711-1) coturn_4.5.1.1-1.1+deb10u1_amd64.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.0.3-1ubuntu0.3_i386.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.0.3-1ubuntu0.3_amd64.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.0.7-1ubuntu2.18.04.2_i386.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.0.7-1ubuntu2.18.04.2_amd64.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.1.1-1.1ubuntu0.19.10.1_i386.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.1.1-1.1ubuntu0.19.10.1_amd64.debLinux
TURN and STUN server for VoIP (USN-4415-1) coturn_4.5.1.1-1.1ubuntu0.20.04.1_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234