Vulnerability · Published Apr 23, 2020 · Assigned by mitre
CVE-2020-11939
Critical 9.8
In plain English
A critical-severity security flaw in the ndpi package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ndpi | 3.4-1 | DEBIAN-CVE-2020-11939 |
| Debian:13 | ndpi | 3.4-1 | DEBIAN-CVE-2020-11939 |
| Debian:14 | ndpi | 3.4-1 | DEBIAN-CVE-2020-11939 |