CVE-2020-14578: 
NixOS vulnerability analysis and mitigation

CVE-2020-14578 affects Java SE and Java SE Embedded, specifically impacting the Libraries component. The vulnerability was disclosed in July 2020 and affects Java SE versions 7u261, 8u251, 11.0.7, 14.0.1 and Java SE Embedded version 8u251 (Oracle CPUJul2020).

The vulnerability is related to an unexpected exception raised by DerInputStream in the Libraries component, specifically in the sun.security.util.DerInputStream.getUnalignedBitString() method. This vulnerability has a CVSS base score of 3.7 (LOW) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (NetApp Advisory).

If successfully exploited, this vulnerability could result in a denial of service condition. The vulnerability allows an unauthenticated attacker with network access to cause a partial denial of service through multiple protocols (NVD).

The vulnerability is considered difficult to exploit, requiring network access via multiple protocols. No known exploits were actively targeting this vulnerability at the time of disclosure (Red Hat Advisory).

The vulnerability was addressed in Java SE versions: 7u261, 8u262, 11.0.8, and 14.0.2. Users are recommended to update to these or later versions. For systems that cannot be immediately updated, all running instances of OpenJDK Java must be restarted after applying the security patches (Red Hat Advisory).