CVE-2020-11939

Katalog CVE

CVSS 9.8 · Critical EPSS 3,3%

Kerentanan Integer Overflow or Wraparound pada ntop ndpi. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.

Rincian

Terbit di NVD

23 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202 patch · advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi exploit · advisory pihak ketiga