CVE-2020-15472: 
NixOS vulnerability analysis and mitigation

CVE-2020-15472 affects nDPI through version 3.2, specifically impacting the H.323 dissector component. The vulnerability was discovered and disclosed on July 1, 2020. The issue affects the ndpi_search_h323 function in lib/protocols/h323.c, where a heap-based buffer over-read vulnerability exists when processing payload packets that are too short (NVD).

The vulnerability occurs in the H.323 protocol dissector implementation within nDPI. The issue specifically manifests in the ndpi_search_h323 function located in lib/protocols/h323.c when processing packets with insufficient length. The vulnerability was addressed by adding additional payload length checks before accessing packet data (GitHub Commit).

A heap-based buffer over-read vulnerability could potentially lead to information disclosure or application crashes when processing malformed H.323 protocol packets. This could affect systems using nDPI for deep packet inspection and network traffic analysis (Debian Security).

The vulnerability can be triggered by sending specially crafted H.323 packets with insufficient length to systems running affected versions of nDPI. The issue requires the ability to send network traffic to the target system that will be processed by the H.323 protocol dissector (NVD).

The vulnerability was fixed in subsequent releases of nDPI. Users should upgrade to a patched version. For Debian 10 (Buster) users, the fix was provided in version 2.6-3+deb10u1 of the ndpi package (Debian Security).