CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

net/turnserver4.16.0

STUN/TURN Server; IPv6, DTLS support; RFCs 5389, 5766, 6062, 6156

Maintainer
portmaster@BSDforge.com
Packages
turnserver 4.16.0
Upstream
Higher version available: 4.18.0
CPE
coturn_project:coturn
WWW
https://github.com/coturn/coturn
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range this version has left.

Commits (64)

Yusuf Yaman (nxjoseph) · 4.16.0
net/turnserver: Update 4.14.0 => 4.16.0

Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).

PR:		297251, 296810
Reported by:	Frank Wall <freebsd@moov.de>
Reported by	Zixu Wu <zx@bv3.dev>
Approved by:	Chris Hutchinson <portmaster@bsdforge.com> (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
Co-authored-by:	Frank Wall <freebsd@moov.de>
Co-authored-by:	Zixu Wu <zx@bv3.dev>
Security:	GHSA-5538-7cxj-5jcc
MFH:		2026Q3
87d11fd730
Vladimir Druzenko (vvd) · 4.14.0
net/turnserver: Update 4.10.0 => 4.14.0 (fix 4 CVEs)

Changelogs:
https://github.com/coturn/coturn/blob/4.14.0/ChangeLog
https://github.com/coturn/coturn/releases/tag/4.11.0
https://github.com/coturn/coturn/releases/tag/4.12.0
https://github.com/coturn/coturn/releases/tag/4.13.0
https://github.com/coturn/coturn/releases/tag/4.13.1
https://github.com/coturn/coturn/releases/tag/4.14.0

- Remove dead mirror from MASTER_SITES.
- Switch from http to https in MASTER_SITES.
- Remove unused dependency gettext-runtime.

PR:		296555
Approved by:	blanket (fix 4 CVEs)
Security:	CVE-2026-53450
Security:	CVE-2026-53449
Security:	CVE-2026-53448
Security:	CVE-2026-43915
Sponsored by:	UNIS Labs
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
MFH:		2026Q2
fd77dbcdcf
Gleb Popov (arrowd) · 4.10.0
net/turnserver: Fix sample configuration file name in pkg-message

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/533
158d2b5d37
Vladimir Druzenko (vvd) · 4.10.0
net/turnserver: Update 4.6.3 => 4.10.0 (fix 3 CVEs)

Changelogs:
https://github.com/coturn/coturn/blob/4.10.0/ChangeLog
https://github.com/coturn/coturn/releases/tag/4.7.0
https://github.com/coturn/coturn/releases/tag/4.8.0
https://github.com/coturn/coturn/releases/tag/4.9.0
https://github.com/coturn/coturn/releases/tag/4.10.0

While here:
- Remove unnecessary PKGNAMEPREFIX.
- Merge INSTALL_PROGRAMs.
- Samplefy installation of the config.
- Merge MKDIRs.
- Remove unnecessary MKDIR.

PR:		294842
Approved by:	blanket (fix 3 CVEs)
Security:	CVE-2026-40613
Security:	CVE-2026-27624
Security:	CVE-2025-69217
Sponsored by:	UNIS Labs
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
MFH:		2026Q2
a330678a63
Vladimir Druzenko (vvd) · 4.6.3
net/turnserver: Update 4.6.2 → 4.6.3

Changelog:
https://github.com/coturn/coturn/blob/4.6.3/ChangeLog

PR:		284168
Approved by:	Chris Hutchinson <portmaster@BSDforge.com> (maintainer, timeout 2 weeks)
MFH:		2025Q1
41a4bc0630
Gleb Popov (arrowd) · 4.6.2_1
*: Move manpages to share/man

PR:		277322
138eb13e8b
Muhammad Moinur Rahman (bofh) · 4.6.2
net/turnserver: Fix build with libressl

- Pet portclippy while I am here

PR:		259735
Approved by:	portmaster@bsdforge.com (maintainer)
8635e9d803
Muhammad Moinur Rahman (bofh) · 4.6.2
net/turnserver: Unbreak with OpenSSL 3.0.0 and later

- Update version 4.5.2=>4.6.2

Changelog: https://github.com/coturn/coturn/releases/tag/4.6.2
Approved by:	portmgr (blanket)
2b71001f45
Koichiro Iwao (meta) · 4.5.2
net/turnserver: assign to reporter, update WWW

PR:		267649
Sponsored by:	Miracle Linux
97fda7e3a5
Rene Ladan (rene) · 4.5.2
all: return bhughes' ports to the pool after safekeeping

With hat:	portmgr-secretary
aac3405804
Stefan Eßer (se) · 4.5.2
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 4.5.2
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Mathieu Arnold (mat) · 4.5.2
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 4.5.2
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 4.5.2
Remove # $FreeBSD$ from Makefiles.
305f148f48
Tobias Kortkamp (tobik) · 4.5.2
Remove redundant option descriptions that match the default ones

(ignoring case)

Reported by:	danfe (for net/mosquitto), portscan
f2499eec5a
Bradley T. Hughes (bhughes) · 4.5.2
net/turnserver: Update 4.5.1.1_2 -> 4.5.2

MFH:		2021Q1
Security:	fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea
Sponsored by:	Miles AS
742b933569
Mathieu Arnold (mat) · 4.5.1.1_2
Convert to UCL & cleanup pkg-message (categories n)

(and missed 3 missed files from previous categories.)
2614c95748
Jan Beich (jbeich) · 4.5.1.1_2
devel/libevent2: update to 2.1.11

Changes:	https://github.com/libevent/libevent/releases/tag/release-2.1.11-stable
ABI:		https://abi-laboratory.pro/tracker/timeline/libevent/
PR:		239599
Reported by:	GitHub (watch releases)
Approved by:	zeising (maintainer)
MFH:		2019Q3 (maybe security, partially restores 2.1.8 ABI)
Differential Revision:	https://reviews.freebsd.org/D21133
f18538b989
Gerald Pfeifer (gerald) · 4.5.1.1_1
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Bradley T. Hughes (bhughes) · 4.5.1.1
net/turnserver: Update 4.5.1.0 -> 4.5.1.1

https://github.com/coturn/coturn/blob/4.5.1.1/ChangeLog

Sponsored by:	Miles AS
cfaca2bf8f
Bradley T. Hughes (bhughes) · 4.5.1.0
net/turnserver: Update 4.5.0.8_1 -> 4.5.1.0

This is a security release that fixes several SQL injection
vulnerabilities. This release also includes several breaking
configuration changes, so users are encouraged to verify their
configuration before and after upgrading.

MFH:		2019Q1
Security:	181beef6-2482-11e9-b4a3-00155d006b02
Sponsored by:	Miles AS
f1b45d024d
Gerald Pfeifer (gerald) · 4.5.0.8_1
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590
a9f015d155
Bradley T. Hughes (bhughes) · 4.5.0.8
net/turnserver: Update 4.5.0.7 -> 4.5.0.8

Change the port to USE_GITHUB, since the project has been hosted there
for some time, and the latest release is only available from Github. The
extradocs package is still only available from turnserver.open-sys.org
or coturn.net

Sponsored by:	Miles AS
e8f92bdfcc
Alexey Dokuchaev (danfe) · 4.5.0.7
Do not abuse INSTALL_MAN when installing documentation, examples, and other miscellaneous files which are not actually manual pages.
2c0789eb84
Bradley T. Hughes (bhughes) · 4.5.0.7
net/turnserver: Update 4.5.0.6 -> 4.5.0.7

Approved by:	robak (mentor)
Differential Revision:	https://reviews.freebsd.org/D13437
d6ec666a99
Jimmy Olgeni (olgeni) · 4.5.0.6
Fix whitespace issues (mixed tab/spaces, alignment) in a few ports.

This round is @FreeBSD.org residents except teams.
e929aea23c
Bradley T. Hughes (bhughes) · 4.5.0.6
multiple ports: Update MAINTANER

Change bradleythughes@fastmail.fm -> bhughes@FreeBSD.org after
receiving my ports commit bit on all ports I maintain: devel/awscli,
devel/py-botocore, net/py-s3transfer, net/turnserver, www/node4,
www/node6, and www/node.

Approved by:	robak (mentor)
Differential Review:	https://reviews.freebsd.org/D11015
956e24e47d
Bartek Rutkowski (robak) · 4.5.0.6
net/turnserver: update 4.5.0.5 -> 4.5.0.6

PR:		218180
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm> (maintainer)
5dcf9e8aea
Jan Beich (jbeich) · 4.5.0.5_2
devel/libevent2: drop historical suffix after r362796

PR:		216777
Approved by:	mm (maintainer)
a9425224f1
Jan Beich (jbeich) · 4.5.0.5_1
devel/libevent2: update to 2.1.8 and cleanup

- DEFAULT_VERSIONS += ssl=openssl-devel is now supported
- devel/py-event and devel/p5-Event-Lib are marked BROKEN

Changes:	https://github.com/libevent/libevent/raw/release-2.1.8-stable/whatsnew-2.1.txt
Changes:	https://github.com/libevent/libevent/raw/release-2.1.8-stable/ChangeLog
PR:		216527
Exp-run by:	antoine
Approved by:	mm (maintainer)
21a7215c9a
John Marino (marino) · 4.5.0.5
net/turnserver: Upgrade version 4.5.0.4 => 4.5.0.5

This fixes build using libreSSL as well as provide two new utilities:
turnutils_natdiscovery and turnutils_auth.  Transfer maintainership
to Bradley Hughes

PR:		213586
Submitted by:	Bradley Hughes
Approved by:	former maintainer (Oleg Moskalenko)
af926685de
Pawel Pekala (pawel) · 4.5.0.4
- Update to version 4.5.0.4 [1] - Convert to USES=mysql ssl - Add USES=gettext-runtime, turnserver links to libintl - Convert to test framework - Convert to options helpers, move options block to proper place - Use options helpers in install targets, simplify install commands - Break lines around 80 characters

PR:		212534 [1]
Submitted by:	Bradley T. Hughes
Approved by:	maintainer
7d7e545429
Dmitry Marakasov (amdmi3) · 4.5.0.3
- Fix trailing whitespace in pkg-messages

Approved by:	portmgr blanket
e87a8bd319
Dmitry Marakasov (amdmi3) · 4.5.0.3
- Fix trailing whitespace in pkg-descrs, categories [g-n]*

Approved by:	portmgr blanket
4e942b6419
Mathieu Arnold (mat) · 4.5.0.3
Remove ${PORTSDIR}/ from dependencies, categories m, n, o, and p.

With hat:	portmgr
Sponsored by:	Absolight
8d6597e0bb
Matthew Seaman (matthew) · 4.5.0.3
Update to 4.5.0.3

- upstreaming SSLv3 related patches

PR:		205948
Submitted by:	bradleythughes@fastmail.fm
Approved by:	mom040267@gmail.com (maintainer)
bf1ff9725d
Baptiste Daroussin (bapt) · 4.5.0.2_1
Convert ports from s* t* and net* categories to USES=sqlite and USES=firebird
af90420500
Kubilay Kocak (koobs) · 4.5.0.2_1
net/turnserver: Fix build with No-SSLv3

turnserver will not build if OpenSSL was built without SSLv3
(--no-ssl3).

LibreSSL 2.3.0 has removed SSLv3 support completely.

This change fixes the build when SSLv3 is not available

While I'm here, add LICENSE_FILE

PR:		203700
Submitted by:	cpbsdmail gmail com
Approved by:	mom040267 gmail com (maintainer)
MFH:		2014Q4
5f9a19226c
Guido Falsi (madpilot) · 4.5.0.2
Update to 4.5.0.2

PR:		203464
Submitted by:	Bradley T. Hughes <bradleythughes at fastmail.fm>
Approved by:	mom040267 at gmail.com (maintainer)
6c0c109cb8
Guido Falsi (madpilot) · 4.5.0.1
Update to 4.5.0.1

PR:		203305
Submitted by:	Bradley T. Hughes <bradleythughes at fastmail.fm>
Approved by:	mom040267 at gmail.com (maintainer)
509567d7f1
Johannes Jost Meixner (xmj) · 4.4.5.3
net/turnserver: update to 4.4.5.3

Upstream announcement:

  IMPORTANT: coturn-4.4.5.3 issued with SQL injection security hole fixed
  The new version features:

  - Third-party authorization STUN attributes adjusted according to the
    values assigned by IANA;
  - SQL injection security hole fixed;
  - Amazon EC2 AMI security strengthened.

  The upgrade is a MUST for all production systems.

PR:	201231
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.com>
Approved by:	maintainer <mom040267@gmail.com>
5196a87515
Guido Falsi (madpilot) · 4.4.5.2
Update to 4.4.5.2

PR:		200715
Submitted by:	Bradley T. Hughes <bradleythughes at fastmail.fm>
Approved by:	mom040267 at gmail.com (maintainer)
11d5af21b6
Guido Falsi (madpilot) · 4.4.4.2
Update net/turnserver to 4.4.4.2

PR:		200168
Submitted by:	Bradley T. Hughes <bradleythughes at fastmail.fm>
Approved by:	mom040267@gmail.com (maintainer)
6ae6dcb630
Dmitry Marakasov (amdmi3) · 3.2.5.7
- Update to 3.2.5.7

PR:		199455
Submitted by:	bradleythughes@fastmail.fm
Approved by:	mom040267@gmail.com (maintainer)
ceeab232bd
Brad Davis (brd) · 3.2.5.6
Update net/turnserver to 3.2.5.6.

Submitted by:	Bradley Hughes <bradleythughes@fastmail.fm>
PR:		198532
Approved by:	bdrewery (mentor)
644aeab593
Dmitry Marakasov (amdmi3) · 3.2.5.4
- Update to 3.2.5.4

PR:		197268
Submitted by:	bradleythughes@fastmail.fm
Approved by:	mom040267@gmail.com (maintainer)
1e2e2a5c26
Baptiste Daroussin (bapt) · 3.2.5.3
Update to 3.2.5.3 [1] While here few cleanup: - Cleanup plist - Avoid extending PORTDOCS in post-install target we prefer to separate targets   and variable definitions - Remove useless post-install - Recommend configuration in ${PREFIX}/etc instead of /etc, the binary also look   for its configurations files in the directory - Cleanup EOL spaces in pkg-message

PR:		196126 [1]
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm>
Approved by:	maintainer [1]
7b61b3df9d
Johannes Jost Meixner (xmj) · 3.2.5.2
net/turnserver:update to 3.2.5.2

- update to 3.2.5.2

Changes:
* TLS connection procedure improved in uclient test program.
* Reliability improvements (Issue 141).
* external address mapping fixes for Amazon EC2.
* docs fixes.

PR:		195801
Differential Revision:	https://reviews.freebsd.org/D1281
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm>
Approved by:	mom040267@gmail.com (maintainer)
Approved by:	koobs (mentor)
0a40a8af9c
Johannes Jost Meixner (xmj) · 3.2.5.1
net/turnserver: upgrade to 3.2.5.1

- upgrade to 3.2.5.1

  Upstream release announcement:

  [RFC5766-TURN-SERVER 1398] Build rfc5766-turn-server-3.2.5.1 is available

  This build does not have updates to the TURN server itself, but it
  dramatically improves the usability of the turnutils_uclient test
  program. It implements the retransmission pattern, now, for unreliable
  protocols (UDP and DTLS) and so it can be used for the real-life
  tests over the worst networks. Previously, it could be used only
  in a controlled environment. This version is very recommended to
  anybody who wants to use turnutils_uclient for performance and/or
  functional tests of their TURN servers.

  - Request re-transmission implemented in uclient test program.
  - TLS connection procedure improved in uclient test program.

PR:		195324
Differential Revision:	https://reviews.freebsd.org/D1253
Submitted by:	Bradley T. Hughes <bradleythughes@fastmail.fm>
Approved by:	swills (mentor)
d4a5ae65b0