CVE catalog

CVE-2020-6061

coturn: CVE-2020-6061

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.12% · Oct 25, 2026

An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information leaks and other misbehavior. An attacker needs to send an HTTPS request to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancoturnsid4.18.0-1fixed
Debiancoturnforky4.18.0-1fixed
Debiancoturntrixie4.6.1-2fixed
Debiancoturnbookworm4.6.1-1fixed
Ubuntucoturn16.044.4.5.4-2vulnerable
Ubuntucoturn16.044.5.0.2-3vulnerable
Ubuntucoturn16.044.5.0.3-1vulnerable
Ubuntucoturn16.044.5.0.3-1build1vulnerable
Ubuntucoturn16.044.5.0.3-1ubuntu0.2vulnerable
Ubuntucoturn16.044.5.0.3-1ubuntu0.3fixed
Ubuntucoturn18.044.5.0.6-1ubuntu2vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu1vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2.18.04.1vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2.18.04.2fixed
Ubuntucoturn20.044.5.1.1-1.1build1vulnerable
Ubuntucoturn20.044.5.1.1-1.1build2vulnerable
Ubuntucoturn20.044.5.1.1-1.1ubuntu0.20.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancoturnsourcesid4.5.1.1-1.2not yet assignedNot reported[951876]
Debiancoturnsourceforky4.5.1.1-1.2not yet assignedNot reported[951876]
Debiancoturnsourcetrixie4.5.1.1-1.2not yet assignedNot reported[951876]
Debiancoturnsourcebookworm4.5.1.1-1.2not yet assignedNot reported[951876]
Ubuntucoturndeb16.044.5.0.3-1ubuntu0.3Not reportedUBUNTU-CVE-2020-6061Not reported
Ubuntucoturndeb18.044.5.0.7-1ubuntu2.18.04.2Not reportedUBUNTU-CVE-2020-6061Not reported
Ubuntucoturndeb20.044.5.1.1-1.1ubuntu0.20.04.1Not reportedUBUNTU-CVE-2020-6061Not reported

[Debian bug #951876]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [coturn]Fixed
    Details (2)

    • 4.6.1-1 · amd64 · bookworm

      Fixed · Fixed: 4.5.1.1-1.2

      dsa · coturn · debian · bookworm; dsa · coturn · debian · 12

    • 4.6.1-1 · arm64 · bookworm

      Fixed · Fixed: 4.5.1.1-1.2

      dsa · coturn · debian · bookworm; dsa · coturn · debian · 12

[Debian 13 (Trixie)]

  • [coturn]Fixed

    Source package: [coturn]

    Details (2)

    • 4.6.1-2 · amd64 · trixie

      Fixed · Fixed: 4.5.1.1-1.2

      dsa · coturn · debian · 13

    • 4.6.1-2+b2 · arm64 · trixie

      Fixed · Fixed: 4.5.1.1-1.2

      dsa · coturn · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]