Fedora 42: coturn CVE-2025

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gateway. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying TURN extension - RFC 6156 - IPv6 extension for TURN - Experimental DTLS support as client protocol. STUN specs: - RFC 3489 - "classic" STUN - RFC 5389 - base "new" STUN specs - RFC 5769 - test vectors for STUN protocol testing - RFC 5780 - NAT behavior discovery support The implementation fully supports the following client-to-TURN-server protocols: - UDP (per RFC 5766) - TCP (per RFC 5766 and RFC 6062) - TLS (per RFC 5766 and RFC 6062); TLS1.0/TLS1.1/TLS1.2 - DTLS (experimental non-standard feature) Supported relay protocols: - UDP (per RFC 5766) - TCP (per RFC 6062) Supported user databases (for user repository, with passwords or keys, if authentication is required): - SQLite - MySQL - PostgreSQL - Redis Redis can also be used for status and statistics storage and notification. Supported TURN authentication mechanisms: - long-term - TURN REST API (a modification of the long-term mechanism, for time-limited secret-based authentication, for WebRTC applications) The load balancing can be implemented with the following tools (either one or a combination of them): - network load-balancer server - DNS-based load balancing - built-in ALTERNATE-SERVER mechanism. Update Information : Backport upstream patches for CVE-2025-69217 (#2425955)

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gateway.

It can be used as a general-purpose network traffic TURN server/gateway, too.

This implementation also includes some extra features. Supported RFCs:

- RFC 5766 - base TURN specs

- RFC 6062 - TCP relaying TURN extension

- RFC 6156 - IPv6 extension for TURN

- Experimental DTLS support as client protocol.

- RFC 3489 - "classic" STUN

- RFC 5389 - base "new" STUN specs

- RFC 5769 - test vectors for STUN protocol testing

- RFC 5780 - NAT behavior discovery support

The implementation fully supports the following client-to-TURN-server protocols:

- TCP (per RFC 5766 and RFC 6062)

- TLS (per RFC 5766 and RFC 6062); TLS1.0/TLS1.1/TLS1.2

- DTLS (experimental non-standard feature)

Supported relay protocols:

Supported user databases (for user repository, with passwords or keys, if

authentication is required):

Redis can also be used for status and statistics storage and notification.

Supported TURN authentication mechanisms:

- TURN REST API (a modification of the long-term mechanism, for time-limited

secret-based authentication, for WebRTC applications)

The load balancing can be implemented with the following tools (either one or a

combination of them):

- network load-balancer server

- DNS-based load balancing

- built-in ALTERNATE-SERVER mechanism.

Backport upstream patches for CVE-2025-69217 (#2425955)

* Sun Jan 4 2026 Robert Scheck - 4.7.0-4 - Backport upstream patches for CVE-2025-69217 (#2425955)

* Sun Jan 4 2026 Robert Scheck - 4.7.0-4 - Backport upstream patches for CVE-2025-69217 (#2425955)

[ 1 ] Bug #2425955 - CVE-2025-69217 coturn: coturn: Authentication bypass and port prediction via predictable random number generation

[ 1 ] Bug #2425955 - CVE-2025-69217 coturn: coturn: Authentication bypass and port prediction via predictable random number generation

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-c75d08ab90' at the command line. For more information, refer to the dnf documentation available at