{"id":"CVE-2025-69217","summary":"Coturn has unsafe nonce and relay port randomization due to weak random number generation.","details":"coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.","aliases":["GHSA-fvj6-9jhg-9j84"],"modified":"2026-08-12T15:14:55.355475Z","published":"2025-12-30T00:41:18.792Z","related":["openSUSE-SU-2026:10375-1","openSUSE-SU-2026:21184-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-338"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69217.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69217.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-fvj6-9jhg-9j84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69217"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"e7c1551de1a153d6a0c16291c7cd4fc601e84982"},{"fixed":"6a0b3a648a0c53efa4b99c5b7034e09fbf66ae52"},{"fixed":"11fc465f4bba70bb0ad8aae17d6c4a63a29917d9"},{"fixed":"88ced471385869d7e7fbbc4766e78ef521b36af6"}],"database_specific":{"extracted_events":[{"introduced":"4.6.2r5"},{"fixed":"4.7.0-r4"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69217.json","vanir_signatures_modified":"2026-08-12T15:14:55Z","vanir_signatures":[{"digest":{"line_hashes":["214236864238421823216790558814134561554","264890891891111266571089548601223478199","199527371270515577088468841474059709594","161194442728405794821832730890518499427","198762068965018823340076781393291601247","140837786261135989635642550601956741366","266646832607508268168030238976907701192","335070634811984056690631349569039814567","112215632770556398464989866642416612363","165598847072016363891520623323127901348","243914836878772284138159850106365794417","186613297262190308780942409519886599705","12423327960293764799449137419174743012","178302868464115368092269987036778460385","96936868366239172309845437694791461039","61714001344089061007110565040073533511","117749886236043010120197614800271781100","274456183258337921434478293181954210929","49209915327517324569221864259464594675","283575614138618150230228967707523751080","127172747652013293555098633952267093929","271569293320604779523097552469903565698","10715553677988732202591218426144996119","304455570996468248220197235243039136783","218089162476102151400014372789197242087","188503631133314530129098698730644987400","320843918588421013482276962998786252043","318464094871736604107924012995144434607","237325317598853323416056635204301676420","285642072799969721448969051561008433808","281591614092659303144682685525723039889","160900624407656897849122940140580875526","61913728138536684639279022150823307668","93222706701349874464054978683490648635","150319400197289290710518507645717982782","104954073243940413045483544168609890911","187850735537865542618992143120564776072","32165233471757263596799243118448773449","136606312377997706335433036200572190805","83825980305256256038620638230347684050","325364444760788593803245694759228933141","163039251307651060939270604818686092054","170142607783081406637762651636456541153","94956055023642592375934624578268794928","74501203430138001154402527885540803409","329068116738451084180919699922566770236","36632316397085281090882154856296948688","75247916472872972160003044920057641107","317379600523097242391215064758360133745","162450909410235140461370829391296906484","34862470772454944617008078994353512480","130629843662606684086753114213586494457","147210392072650657294110643408634450729","67426819015359260072335190888631844369","235339157830609262176017652000519703080","29202373781606005075139352425424338060","304163102959980857221090277438823829227","73791375072297705099902798334358906308","51094444841048572162050059353768191883","12590577867107396590795621758550149127","253367252119085011829659781386394242908","132059707363073714877130340419428601561","34244346218071613976084094535664867610","336480544963546668196630651875058692137","110226709684649027665689560276888441755","185652680208466464050227744913603435344","157842884031510527666253042451850448957","61602515160381649851233389848704603472","168495761881689847230534071773060031276","62873099295767745517531159996235425385","149497104586255452994829749510840669606","123019516059660589693634992781144208106","72616596243566678670618342583974311289","295815372290758742558647026389493864280","235339157830609262176017652000519703080","29202373781606005075139352425424338060","304163102959980857221090277438823829227","73791375072297705099902798334358906308","51094444841048572162050059353768191883","12590577867107396590795621758550149127","253367252119085011829659781386394242908","132059707363073714877130340419428601561","34244346218071613976084094535664867610","336480544963546668196630651875058692137","110226709684649027665689560276888441755","185652680208466464050227744913603435344","61913728138536684639279022150823307668","93222706701349874464054978683490648635","150319400197289290710518507645717982782","104954073243940413045483544168609890911","187850735537865542618992143120564776072","32165233471757263596799243118448773449","136606312377997706335433036200572190805","83825980305256256038620638230347684050","325364444760788593803245694759228933141","163039251307651060939270604818686092054","170142607783081406637762651636456541153","94956055023642592375934624578268794928","74501203430138001154402527885540803409","329068116738451084180919699922566770236","36632316397085281090882154856296948688","113546736436641227434987795560535383364","338786263878906872754394763966600987962","236472667460818367697119109500720509972","34862470772454944617008078994353512480","130629843662606684086753114213586494457","147210392072650657294110643408634450729","67426819015359260072335190888631844369","235339157830609262176017652000519703080","29202373781606005075139352425424338060","304163102959980857221090277438823829227","73791375072297705099902798334358906308","51094444841048572162050059353768191883","12590577867107396590795621758550149127","253367252119085011829659781386394242908","132059707363073714877130340419428601561","34244346218071613976084094535664867610","336480544963546668196630651875058692137","182672373771754752449167887774673108065","308295497447488995174607561898142624905","34862470772454944617008078994353512480","130629843662606684086753114213586494457","147210392072650657294110643408634450729","104954073243940413045483544168609890911","187850735537865542618992143120564776072","32165233471757263596799243118448773449","136606312377997706335433036200572190805","2096973521835313884741252683623383624","257176773719050368066405443555205684634","337208594527695907194414935729808940618","5164474353101714447807606823751923888","49988104995708463756170803262148234044","194953555015737874738091318503697021106"],"threshold":0.9},"id":"CVE-2025-69217-1ad86c88","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9","target":{"file":"src/apps/uclient/startuclient.c"},"deprecated":false},{"target":{"file":"src/server/ns_turn_server.c"},"deprecated":false,"digest":{"line_hashes":["331076185605938912203941836647321560019","265080854591668768878144568866581495940","262107510140970849533260143906078632664","340004708906780818840059119459949423842","151619534228870180686331111571236768922","204982900339873889522673049099918924500","2446808952775264930115090999119293896","255005706429715947078903464383532108399","36526407363682339994654221457253682205","215583182780092878482828922335328405056","116629061603896683035910946312046618850","88147698394263996997247124424157375286","237402347767775118459543897300281225014","44833677817979908469713508000903807662","173743884202434410092836290150418462213","305472168300448019167574559014610887948","247735702445488657808167671217734989336"],"threshold":0.9},"id":"CVE-2025-69217-1cfc2b53","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9"},{"target":{"file":"src/client/ns_turn_msg.h"},"deprecated":false,"digest":{"line_hashes":["164842828617088335868835279577915982116","183734301795430550389764243734343802032","328066729819783170854549823331781069986","113688307329753373725431667819579191784"],"threshold":0.9},"id":"CVE-2025-69217-28e6b0cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9"},{"digest":{"line_hashes":["51872804669314883032323118346509444024","132565151369929415552891279967041257988","164800015545428289036690824662930170236","37672411267367407096784170218731018129","66599320385918175923319181578258455908","57151856455074692480569204156169918889","255228997936868652534342984832249450133","337966247626833669683145792098378725746","181035504897326175813391125811469581695"],"threshold":0.9},"id":"CVE-2025-69217-372faac3","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9","target":{"file":"src/apps/relay/turn_ports.c"},"deprecated":false},{"id":"CVE-2025-69217-40d16d33","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9","target":{"file":"src/apps/relay/ns_ioalib_engine_impl.c"},"deprecated":false,"digest":{"line_hashes":["224626758254482990074685541147089587412","44405413953673108560496445888361115539","186392150999779695699577394794929950252","204618652767758781868561031125446001758","230768590644715209586649819220121364866","18883103982325892672685498729306756231","293383650943207518536299840581471669320","108515804088832063763671529112199980638"],"threshold":0.9}},{"id":"CVE-2025-69217-7ec19555","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9","target":{"file":"src/apps/uclient/uclient.c"},"deprecated":false,"digest":{"line_hashes":["212645240247905226576872119551399071859","298441132879059891753662578965973643514","199018494742257920427355251983491917721","73851096730192168509669636245095014476","329811812267307307194607441887142052062","179036647026404482386040224455073927880","113159245981358625111216543327290325613","90395279724177445489275131195814937255","177886721451562982233768499419841522235","146145431145258792286156209329561480347","121338942143910213745898687160934076453","9298974424544795122060730607327856270","274240851345282644824645086825373907798","220230258270472284498716221867007360213","312316614090908735728021994117928866435","1960774594917178292990518286490789444","205900732104743664988695863540982106747","307970513459675074148963791326534208573","170768117811144456504729767659655107353","54576869870853436301960172927051480611","119424231374328143288983368693046653386","86317044189531913625688224223588348846","42601619821692187679172546142378855349","313656804969796578881526785786324196832","263580740383065380247991418719617624784","179092100797808894519334563927995125848","280747588622656342146946927768824329038","172929596953189565753362889527804234537","158150258831978549060032318654288524620","247234599635499713167240466629819578426","255555502790603282391366436723504339302","297557971451002083274007618611852145127"],"threshold":0.9}},{"digest":{"line_hashes":["315666085638214463586032089169833461128","12375284576361825748737262807567839772","211988205183708511096592680574396196928","108506971190631940488265042949666152651"],"threshold":0.9},"id":"CVE-2025-69217-abad3b33","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9","target":{"file":"src/server/ns_turn_allocation.c"},"deprecated":false},{"source":"https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6","target":{"file":"src/apps/common/apputils.c"},"deprecated":false,"digest":{"line_hashes":["124562052418420888273531982775292552718","295400061807953491963515747255077448092","315526809118164184311428419309590872811"],"threshold":0.9},"id":"CVE-2025-69217-aca2fa22","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6","target":{"file":"src/apps/common/apputils.h"},"deprecated":false,"digest":{"line_hashes":["171168467351387330034862871571840790855","234293457968104866971047287507401899792","83309533431716281004534515185526810120","338937642917069689562483624553428822244"],"threshold":0.9},"id":"CVE-2025-69217-cd26beb1","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-69217-ea55fe2d","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6","target":{"file":"src/client/ns_turn_msg.c"},"deprecated":false,"digest":{"line_hashes":["336081140188136859565830823105347541871","306081338385208892449308502081286907798","79347713568250576621131741683341929890","40442301216843665869506273905242065809","254620906810336504689604429224446783688","68269438216846796205634393727853113847","165784601807992691691066019188262819321","289853299660589367914647309890780530303","196360899207579120872126949430182346016","139528864009996402087312097028221071403","332809219518469564621985914804222800144","321873281657054203134782490752857048310","301428455994323779934666875087306203816","334926946518697225392136245709138138787","296598193358587958462784296136237251210","317780756060313052059029753211645415451"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}]}