Arch Linux Security Advisory ASA-202101-21

Severity: High
Date    : 2021-01-12
CVE-ID  : CVE-2020-26262
Package : coturn
Type    : insufficient validation
Remote  : Yes
Link    :


The package coturn before version 4.5.2-1 is vulnerable to insufficient


Upgrade to 4.5.2-1.

# pacman -Syu "coturn>=4.5.2-1"

The problem has been fixed upstream in version 4.5.2.




A security issue was found in coturn before version 4.5.2. By default
coturn does not allow peers to connect and relay packets to loopback
addresses in the range of 127.x.x.x. However, it was observed that when
sending a CONNECT request with the XOR-PEER-ADDRESS value of, a
successful response was received and subsequently, CONNECTIONBIND also
received a successful response. Coturn then is able to relay packets to
the loopback interface. Additionally, when coturn is listening on IPv6,
which is default, the loopback interface can also be reached by making
use of either [::1] or [::] as the peer address.


A malicious attacker might relay packets to the loopback interface due
to insufficient validation of the connection.