Stack Overflow Vulnerability in nDPI TLS Protocol Processing
CVE-2020-15474

9.8CRITICAL

Key Information:

Vendor

Ntop

Status
Ndpi
Vendor
CVE Published:
1 July 2020

What is CVE-2020-15474?

A stack overflow vulnerability exists in the nDPI network detection library, specifically within the TLS protocol handling in the extractRDNSequence function. This flaw arises from improper processing of input data which may allow for the execution of arbitrary code or could lead to a denial of service. This vulnerability affects versions up to 3.2 of nDPI, creating risks for systems utilizing this library for traffic detection and analysis. Users are advised to review their systems and apply necessary patches to mitigate potential exploitation risks.

References

https://github.com/ntop/nDPI/commit/23594f036536468072198...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.