CVE-2020-14577: 
NixOS vulnerability analysis and mitigation

CVE-2020-14577 is a security vulnerability discovered in Java SE and Java SE Embedded that affects the HostnameChecker component in the JSSE (Java Secure Socket Extension) subsystem. The vulnerability was disclosed in July 2020 and affects Java SE versions through 7u261, 8u251, 11.0.7, 14.0.1 and Java SE Embedded version 8u251 (NVD, Oracle Advisory).

The vulnerability stems from the HostnameChecker not ensuring X.509 certificate names are in normalized form during certificate verification. This issue was discovered by Philippe Arteau of GoSecure (Oracle Advisory).

If exploited, this vulnerability could allow an attacker to obtain sensitive information by bypassing certificate verification checks. The vulnerability has a CVSS v3.1 base score of 3.7 (LOW) with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (Red Hat Advisory).

The vulnerability has been fixed in Java SE versions 7u271, 8u261, 11.0.8, and 14.0.2. Users should upgrade to these or later versions. For systems that cannot be immediately upgraded, all running instances of Java must be restarted after applying any security updates (Red Hat Advisory).