CVE-2020-13962: 
NixOS vulnerability analysis and mitigation

CVE-2020-13962 affects Qt versions 5.12.2 through 5.14.2, specifically impacting the OpenSSL error handling in QSslSocket. The vulnerability was discovered in April 2020 and publicly disclosed in June 2020. The issue affects various products using these Qt versions, with unofficial builds of Mumble 1.3.0 being a notable example (NVD, CVE).

The vulnerability stems from Qt incorrectly calling SSL_shutdown() in OpenSSL mid-handshake, causing errors to leak in unrelated TLS sessions. This mishandling of OpenSSL's error queue results in a specific error (error:140E0197:SSL routines:SSL_shutdown:shutdown while in init) that affects QSslSocket users (Qt Bug, Mumble Issue).

The vulnerability can cause a denial of service condition where unrelated TLS sessions may be disconnected when any handshake fails. This means that closing one connection early could terminate other TLS connections, leading to a potentially severe disruption of service (Gentoo Security).

The vulnerability can be exploited remotely to cause denial of service in applications using affected Qt versions. The issue was demonstrated to be particularly impactful in Mumble server implementations, where it could cause random authenticated clients to be disconnected (Mumble PR).

The vulnerability was fixed in Qt 5.14.2-r1 and later versions. For affected systems, upgrading to these versions is recommended. Mumble 1.3.1 and later are not affected regardless of the Qt version used. Various Linux distributions have released security updates to address this vulnerability (Fedora Update, Gentoo Security).