coturn source package in Ubuntu


coturn ( unstable; urgency=medium

  * Sync to upstream
    - Fix CVE-2018-4058: coTURN unsafe loopback forwarding
      default configuration vulnerability
      - by default loopback disabled
      - no-loopback option removed!
      - allow-loopback-peers option added
    - Fix CVE-2018-4056: coTURN Administrator Web Portal
      SQL injection vulnerability
      - Web admin disabled by default
      - Web admin could listen on separated IP and port
      - web-admin-ip option added
      - web-admin-port option added
      - Web admin is disabled on STUN/TURN ports.
      - web-admin-listen-on-workers option added
        to enable web-admin STUN/TURN ports
    - Fix CVE-2018-4059: coTURN server unsafe telnet admin
      portal default configuration vulnerability
      - An empty cli-password with an allow-loopback-peers option is prohibited.
    - fix memory leak in read_config_file

 -- Mészáros Mihály <email address hidden>  Mon, 28 Jan 2019 13:16:57 +0100

Upload details

Uploaded by:
Debian VoIP Team on 2019-01-28
Uploaded to:
Original maintainer:
Debian VoIP Team
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section


File Size SHA-256 Checksum
coturn_4.5.1.0-1.dsc 2.1 KiB e4e7a29619c089f754b7d9f2fec668837b6695e8bbc8504f435e3d831f645d82
coturn_4.5.1.0.orig.tar.gz 401.3 KiB b84581a46dd40ad674f2905d680e9d0be9743fbbc001198dd498a584fd2fbd15
coturn_4.5.1.0-1.debian.tar.xz 10.3 KiB 8e6486316d8eaeb643c64e56d02855a699097137af6ed28229af9cf042113159

No changes file available.

Binary packages built by this source

coturn: TURN and STUN server for VoIP

 STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays
 around NAT) are protocols that can be used to provide NAT traversal for VoIP
 and WebRTC. This package provides a VoIP media traffic NAT traversal server
 and gateway.
 Supported RFCs:
 TURN specs:
  * RFC 5766 - base TURN specs;
  * RFC 6062 - TCP relaying TURN extension;
  * RFC 6156 - IPv6 extension for TURN;
  * RFC 7635 - OAuth third-party TURN/STUN authorization;
  * DTLS support as client protocol
  * Mobile ICE (MICE) support
  * TURN ORIGIN specs for multi-tenant servers
  * TURN Bandwidth draft specs
  * SSODA (dual allocation) draft specs
 STUN specs:
  * RFC 3489 - obsolete "classic" STUN specs;
  * RFC 5389 - base "new" STUN specs;
  * RFC 5769 - test vectors for STUN protocol testing;
  * RFC 5780 - NAT behavior discovery support.
 The implementation fully supports UDP, TCP, TLS, and DTLS as protocols between
 the TURN client and the TURN server. Both UDP and TCP relaying are supported.
 SQLite, MySQL, PostgreSQL and Redis are supported for the user
 repository (if authentication is required).
 The long-term credentials mechanism is supported.
 For WebRTC applications,
 the TURN server REST API for time-limited
 secret-based authentication is implemented.
 The third-party authentication
 specs (OAuth-based) are supported, too.
 Load balancing can be implemented either by DNS round-robin mechanism, or with
 the external networking tools, or by
 the built-in ALTERNATE-SERVER mechanism.
 The implementation is intended to be simple to install and configure.
 The project focuses on performance, scalability, and simplicity.
 The aim is to provide an enterprise-grade TURN solution.

coturn-dbgsym: debug symbols for coturn