CVE-2020-12409: 
NixOS vulnerability analysis and mitigation

CVE-2020-12409 is a URL spoofing vulnerability discovered in Mozilla Firefox versions prior to 77. The vulnerability was disclosed on June 2, 2020, and affects the browser's URL handling mechanism. When using certain blank characters in a URL, they were incorrectly rendered as spaces instead of being properly encoded, potentially leading to URL spoofing attacks (Mozilla Advisory, NVD).

The vulnerability specifically involves the handling of Unicode character U+2800 (Braille blank) in URLs. Instead of properly encoding this character, Firefox would display it as an invisible character, which could be exploited in combination with RTL (Right-to-Left) characters to create misleading URLs. The vulnerability received a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The primary impact of this vulnerability is the potential for URL spoofing attacks. An attacker could craft URLs using specific Unicode characters to make the browser display a misleading URL in the address bar, potentially tricking users into believing they are visiting a legitimate website when they are actually on a malicious one (Mozilla Advisory).

The vulnerability requires user interaction to be exploited, as the user needs to visit a specially crafted URL. The issue was particularly concerning when used in combination with RTL characters, which could result in bidi reordering and make it unclear which part of the URL is the domain and which is the path (Bugzilla).

The vulnerability was fixed in Firefox version 77, released in June 2020. The fix involved modifying how Firefox handles the U+2800 character in URLs, ensuring it is properly encoded rather than displayed as an invisible character. Users were advised to upgrade to Firefox 77 or later to receive the security fix (Mozilla Advisory).