By default coturn does not allow peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. However, it was observed that when sending a CONNECT request with the XOR-PEER-ADDRESS value of 0.0.0.0, a successful response was received and subsequently, CONNECTIONBIND also received a successful response. Coturn then is able to relay packets to the loopback interface.
Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either [::1] or [::] as the peer address.
Thanks for the report! They're really helpful for keeping on top of various vulnerabilities in packages, especially when they haven't received a (public) CVE yet.
I've adjusted the summary because we don't version them until we have a fixed version in Gentoo.
@maintainer, please bump to 4.5.2.
I bumped the ebuild to 4.5.2 and removed the old version now.
Sorry for the delay!
(In reply to Andreas Schürch from comment #3)
> I bumped the ebuild to 4.5.2 and removed the old version now.
> Sorry for the delay!
Thanks! Tree is clean, all done.