CVE-2021-36082: 
NixOS vulnerability analysis and mitigation

ntop nDPI 3.4 contains a stack-based buffer overflow vulnerability in the processClientServerHello function (OSS-Fuzz Report). The vulnerability was discovered and published on February 8, 2021, and was later fixed in a subsequent update (GitHub Commit).

The vulnerability exists in the TLS protocol processing code, specifically in the processClientServerHello function within the TLS processing block. The issue manifests as a stack-based buffer overflow WRITE condition during the processing of TLS handshake messages (OSS-Fuzz Report). The vulnerability was introduced in commit 32bd3d7a and fixed in commit 1ec621c85b9411cc611652fd57a892cfef478af3.

The vulnerability has been classified as HIGH severity according to the ecosystem-specific assessment (OSS-Fuzz Vulns). Stack-based buffer overflows can potentially lead to system crashes, memory corruption, or arbitrary code execution.

The vulnerability has been fixed in the nDPI codebase through additional checks and buffer size validations. The fix was implemented in commit 1ec621c85b9411cc611652fd57a892cfef478af3, which added further checks to prevent buffer overflow conditions (GitHub Commit).