Bug#1142275: coturn: CVE-2026-53449 CVE-2026-53450

[Salvatore Bonaccorso]

Source: coturn
Version: 4.12.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for coturn.

CVE-2026-53449[0]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, the psd print sessions dump CLI command in coturn
| takes a filename argument and directly passes it to fopen with no
| path validation. An authenticated admin with CLI access can
| overwrite arbitrary files writable by the coturn process because the
| command string is used as-is after stripping the psd prefix and
| leading spaces, allowing truncation and overwrite with session dump
| data. This issue is fixed in version 4.13.0.


CVE-2026-53450[1]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.13.0, coturn rejects loopback peers by default unless
| allow-loopback-peers is enabled, but the default loopback guard can
| be bypassed by using the IPv4-mapped IPv6 peer address
| ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute.
| ioa_addr_is_loopback checks for the literal IPv6 loopback shape
| before IPv4-mapped IPv6 handling, so good_peer_addr does not apply
| the default loopback rejection and an authenticated TURN client can
| expose services bound only to localhost on the coturn host through
| TURN relay traffic. This issue is fixed in version 4.13.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53449
    https://www.cve.org/CVERecord?id=CVE-2026-53449
[1] https://security-tracker.debian.org/tracker/CVE-2026-53450
    https://www.cve.org/CVERecord?id=CVE-2026-53450

Regards,
Salvatore