CVE-2018-4058: High severity coturn vulnerability
An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-4058?
CVE-2018-4058 is considered a high severity vulnerability due to its potential to expose internal services to external attacks.
How do I fix CVE-2018-4058?
To fix CVE-2018-4058, upgrade coTURN to version 4.5.1.1-1.1+deb10u2 or later, which addresses this vulnerability.
What systems are affected by CVE-2018-4058?
CVE-2018-4058 affects coTURN versions prior to 4.5.0.9, allowing unsafe default configurations for the TURN server.
Can CVE-2018-4058 allow access to private services?
Yes, CVE-2018-4058 can allow attackers to access private services running on the host by relaying external traffic.
What is coTURN in the context of CVE-2018-4058?
coTURN is an open-source TURN server implementation that facilitates media relay for WebRTC applications, which is impacted by CVE-2018-4058.