CVE-2019-20919: 
NixOS vulnerability analysis and mitigation

CVE-2019-20919 is a vulnerability discovered in the DBI module before version 1.643 for Perl. The vulnerability was disclosed in September 2020 and affects the database access Application Programming Interface (API) for the Perl Language. The issue stems from improper handling of NULL pointer checks in the code (NVD, Ubuntu Security).

The vulnerability occurs when the hv_fetch() function performs a NULL check as required by documentation, but subsequently makes an unconditional call to SvOK(profile), resulting in a NULL pointer dereference. The issue has been assigned a CVSS v3.1 base score of 4.7 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and high availability impact (NVD).

The vulnerability can lead to a denial-of-service condition through application crashes when a NULL pointer is dereferenced. The impact is primarily on the availability of the system, with no direct impact on confidentiality or integrity (Debian LTS, Ubuntu Security).

The vulnerability requires local access with low privileges and high attack complexity to exploit. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in DBI version 1.643. Various Linux distributions have released security updates to address this issue: Ubuntu has released updates for versions 18.04 (1.640-1ubuntu0.2), 16.04 (1.634-1ubuntu0.2), and 14.04 (1.630-1ubuntu0.1~esm5), OpenSUSE has released updates for Leap 15.1 and 15.2, and Debian has released version 1.636-1+deb9u1 for Debian 9 stretch (USN-4534-1, OpenSUSE).