[From nobody Mon Jul 20 13:55:10 2026
Received: (at submit) by bugs.debian.org; 17 Jul 2026 05:04:11 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 22; hammy, 150; neutral, 70; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug,
 0.000-+--H*Ad:N*Tracking
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wkak6-00GVJv-1m
 for submit@bugs.debian.org; Fri, 17 Jul 2026 05:04:11 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: coturn: CVE-2026-53449 CVE-2026-53450
Message-ID: <178426464872.478323.15862901537052889174.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0+nmu1
Date: Fri, 17 Jul 2026 07:04:08 +0200
Delivered-To: submit@bugs.debian.org

Source: coturn
Version: 4.12.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for coturn.

CVE-2026-53449[0]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, the psd print sessions dump CLI command in coturn
| takes a filename argument and directly passes it to fopen with no
| path validation. An authenticated admin with CLI access can
| overwrite arbitrary files writable by the coturn process because the
| command string is used as-is after stripping the psd prefix and
| leading spaces, allowing truncation and overwrite with session dump
| data. This issue is fixed in version 4.13.0.


CVE-2026-53450[1]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, coturn rejects loopback peers by default unless
| allow-loopback-peers is enabled, but the default loopback guard can
| be bypassed by using the IPv4-mapped IPv6 peer address
| ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute.
| ioa_addr_is_loopback checks for the literal IPv6 loopback shape
| before IPv4-mapped IPv6 handling, so good_peer_addr does not apply
| the default loopback rejection and an authenticated TURN client can
| expose services bound only to localhost on the coturn host through
| TURN relay traffic. This issue is fixed in version 4.13.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53449
    https://www.cve.org/CVERecord?id=CVE-2026-53449
[1] https://security-tracker.debian.org/tracker/CVE-2026-53450
    https://www.cve.org/CVERecord?id=CVE-2026-53450

Regards,
Salvatore
]