CVE-2020-14148: 
NixOS vulnerability analysis and mitigation

CVE-2020-14148 is a vulnerability discovered in ngIRCd (Next Generation IRC Daemon) before version 26~rc2, disclosed on June 15, 2020. The vulnerability affects the Server-Server protocol implementation, allowing an out-of-bounds access through the IRC_NJOIN() function (CVE Details, NVD).

The vulnerability exists in the Server-Server protocol implementation where an out-of-bounds access can occur through the IRC_NJOIN() function. The issue was discovered through fuzzing using American Fuzzy Lop (AFL) and libdislocate testing tools. The vulnerability has a CVSS v3.1 Base Score of 7.5 (High), with an Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, and High impact on Availability (AttackerKB).

The vulnerability can lead to a server crash through out-of-bounds access, primarily affecting the availability of the IRC service. However, the impact is limited to the server-server protocol and cannot be triggered by regular clients (GitHub Issues).

The vulnerability requires access to server-server communications and cannot be exploited by regular IRC clients. It specifically affects authenticated server-server connections, making it a lower risk in typical deployments. The vulnerability was initially discovered through security testing using AFL fuzzing tools (GitHub Issues).

The vulnerability was fixed in ngIRCd version 26~rc2. Users are recommended to upgrade to this version or later. Multiple distributions have released security updates, including Debian 8 'Jessie' (version 22-2+deb8u1), Fedora 31 and 32 (version 26-3) (Debian LTS, Fedora Update).