Debian Package Tracker

general

source: ndpi (main)
version: 3.0-1
maintainer: Ludovico Cavedon (DMD)
arch: any
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.5.0-1
oldstable: 1.8-1
stable: 2.6-3
unstable: 3.0-1

versioned links

1.5.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.6-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.6-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libndpi-bin
libndpi-dev
libndpi-wireshark
libndpi3.0

action needed

A new upstream version is available: 3.2 high

A new upstream version 3.2 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2020-08-03 17:01

8 security issues in sid high

There are 8 open security issues in sid.

8 important issues:

CVE-2020-11939: In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
CVE-2020-15476: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CVE-2020-15475: In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
CVE-2020-15474: In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
CVE-2020-15473: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
CVE-2020-15472: In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
CVE-2020-15471: In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
CVE-2020-11940: In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.

Please fix them.

Created: 2020-04-27 Last update: 2020-07-06 19:34

4 security issues in buster high

There are 4 open security issues in buster.

4 important issues:

CVE-2020-15476: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CVE-2020-15475: In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
CVE-2020-15473: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
CVE-2020-15472: In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.

Please fix them.

Created: 2020-07-02 Last update: 2020-07-06 19:34

4 security issues in stretch high

There are 4 open security issues in stretch.

4 important issues:

CVE-2020-15476: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CVE-2020-15475: In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
CVE-2020-15473: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
CVE-2020-15472: In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.

Please fix them.

Created: 2020-07-02 Last update: 2020-07-06 19:34

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2020-01-03 Last update: 2020-08-03 20:34

Depends on packages which need a new maintainer normal

The packages that ndpi depends on which need a new maintainer are:

dh-exec (#851746)
- Build-Depends: dh-exec

Created: 2019-11-22 Last update: 2020-08-03 19:34

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.2-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 98ff1b7ae9bfc5741bf129daf2b4a6aa17c2b1f2
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:37:54 2020 +0200

    add TODO in changelog file

commit b61dbbc37ea2fdbc3905f1df5c07edfa77f078f8
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:11:28 2020 +0200

    Update changelog

commit deac3e2961df94303d680aa4bc1873917e5407d1
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:24:17 2020 +0200

    Bump libndpi to 3.2

commit 92890f4f24f4bb1ec1c28bf8f211e28abfad0dbb
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:10:29 2020 +0200

    Drop dh_auto_install override: txt files are now correctly installed upstream

commit d2ec35974d536c766aff1f1c1f459e52c3e5211e
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:10:02 2020 +0200

    Rebase patches for new release (keeping one little library as static)

commit 9ec68c7e6c0804de8079a68c2d5b4a8cc24304ae
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:09:42 2020 +0200

    Drop old define-have-json-c.patch: not needed anymore

commit 4df6aad3e66c573e60522922fd1f6b5abc7c41e4
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Fri Jul 3 12:09:01 2020 +0200

    Bump std-version to 4.5.0, and compat level to 13

commit 1b5c7b73a604882d6ebb5054d61a53893359b100
Merge: a3a24d3 604ed40
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Wed Jul 1 22:44:03 2020 +0200

    Update upstream source from tag 'upstream/3.2'
    
    Update to upstream version '3.2'
    with Debian dir 4a3495573ccf2586e96c0e521aa5c96c3e088458

commit 604ed40c10478723e97563ca14d0337a0a562b5e
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Wed Jul 1 22:42:47 2020 +0200

    New upstream version 3.2

Created: 2020-07-03 Last update: 2020-07-31 07:05

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-08-10 Last update: 2019-08-10 23:36

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.4.1).

Created: 2020-01-21 Last update: 2020-01-21 05:06

testing migrations

excuses:
- Migration status for ndpi (- to 3.0-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- Updating ndpi introduces new bugs: #950404
- missing build on arm64
- missing build on i386
- missing build on ppc64el
- missing build on s390x
- arch:arm64 not built yet, autopkgtest delayed there
- Additional info:
- Piuparts tested OK - https://piuparts.debian.org/sid/source/n/ndpi.html
- 219 days old (needed 5 days)
- Not considered

news

[rss feed]

[2020-06-22] ndpi REMOVED from testing (Debian testing watch)
[2019-12-29] Accepted ndpi 3.0-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2019-09-22] ndpi 2.6-5 MIGRATED to testing (Debian testing watch)
[2019-09-17] Accepted ndpi 2.6-5 (source) into unstable (Gianfranco Costamagna)
[2019-09-17] ndpi 2.6-4 MIGRATED to testing (Debian testing watch)
[2019-09-12] Accepted ndpi 2.6-4 (source) into unstable (Gianfranco Costamagna)
[2019-01-21] ndpi 2.6-3 MIGRATED to testing (Debian testing watch)
[2019-01-16] Accepted ndpi 2.6-3 (source amd64) into unstable (Ludovico Cavedon)
[2019-01-15] Accepted ndpi 2.6-2 (source amd64) into unstable (Ludovico Cavedon)
[2019-01-14] Accepted ndpi 2.6-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2017-12-30] Accepted ndpi 2.2-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2016-12-23] ndpi 1.8-1 MIGRATED to testing (Debian testing watch)
[2016-12-11] Accepted ndpi 1.8-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2016-03-19] ndpi 1.7.1~git20151130.6f3d5a7-1 MIGRATED to testing (Debian testing watch)
[2016-03-14] Accepted ndpi 1.7.1~git20151130.6f3d5a7-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2015-10-03] ndpi 1.6-1 MIGRATED to testing (Britney)
[2015-09-22] Accepted ndpi 1.6-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2014-08-25] ndpi 1.5.0-1 MIGRATED to testing (Britney)
[2014-08-19] Accepted ndpi 1.5.0-1 (source amd64) into unstable, unstable (Ludovico Cavedon)
[2013-11-28] ndpi 1.4.0+svn6932-1 MIGRATED to testing (Debian testing watch)
[2013-11-17] Accepted ndpi 1.4.0+svn6932-1 (source amd64) (Ludovico Cavedon)
[2013-09-18] ndpi 1.4.0+svn6712-1 MIGRATED to testing (Debian testing watch)
[2013-09-08] Accepted ndpi 1.4.0+svn6712-1 (source amd64) (Ludovico Cavedon)

bugs [bug history graph]

all: 3
RC: 1
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, checks, clang, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.6-5