CVE-2020-15473: 
NixOS vulnerability analysis and mitigation

In nDPI through version 3.2, a heap-based buffer over-read vulnerability was discovered in the OpenVPN dissector, specifically in the ndpi_search_openvpn function within lib/protocols/openvpn.c. The vulnerability was assigned CVE-2020-15473 and was publicly disclosed in July 2020 (NVD, CVE).

The vulnerability exists in the OpenVPN protocol dissector component of nDPI, specifically affecting the ndpi_search_openvpn function. The issue stems from improper bounds checking when processing OpenVPN packets, which could lead to a heap-based buffer over-read condition. A fix was implemented that includes additional boundary checks and proper handling of payload length calculations, as evidenced in the patch (GitHub Commit).

A successful exploitation of this vulnerability could allow an attacker to cause a heap-based buffer over-read, potentially leading to information disclosure or application crashes (NVD).

The vulnerability has been addressed through a patch that implements proper boundary checks and payload length handling. Users should upgrade to a version of nDPI newer than 3.2 that contains the security fix (GitHub Commit).