CVE-2020-14150: 
NixOS vulnerability analysis and mitigation

GNU Bison before version 3.5.4 contains a denial of service vulnerability (CVE-2020-14150). The vulnerability was discovered and disclosed in June 2020, affecting the GNU Bison parser generator. It's important to note that this vulnerability only poses a risk when Bison is used with untrusted input, and when an observed bug causes unsafe behavior with specific compiler/architecture combinations (Debian Tracker).

The vulnerability allows attackers to cause a denial of service through application crashes. The CVSS v3.1 base score for this vulnerability is 7.5, with attack vector being Network, attack complexity Low, and no privileges or user interaction required. The primary impact is on availability, with no direct impact on confidentiality or integrity (Oracle Bulletin).

The primary impact of this vulnerability is the potential for application crashes when processing untrusted input. The bug reports were specifically intended to demonstrate crashes in Bison itself, rather than in code generated by Bison. The vulnerability's scope is limited to scenarios where Bison processes untrusted input with specific compiler and architecture combinations (Debian Tracker).

The vulnerability requires network access and has low attack complexity. While the vulnerability can be exploited remotely without authentication, it's important to note that the risk only exists when Bison is used with untrusted input (Oracle Bulletin).

The vulnerability was fixed in GNU Bison version 3.5.4, released on April 5, 2020. Users are advised to upgrade to this version or later to mitigate the vulnerability. Various distributions have also released patches for their respective versions, including Debian which fixed the issue in version 2:3.7.5+dfsg-1 for bullseye and 2:3.8.2+dfsg-1 for sid, trixie, and bookworm (Debian Tracker).