CVE-2020-14792: 
NixOS vulnerability analysis and mitigation

CVE-2020-14792 is a vulnerability in the Java SE and Java SE Embedded products, specifically affecting the Hotspot component. The affected versions include Java SE versions 7u271, 8u261, 11.0.8, and 15, as well as Java SE Embedded version 8u261. This vulnerability was disclosed in October 2020 as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability is characterized as a difficult-to-exploit integer overflow condition that can lead to out-of-bounds access in the Hotspot component. It has a CVSS 3.1 Base Score of 4.2 (Medium severity) with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network accessibility with high attack complexity and requiring user interaction (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data, as well as unauthorized read access to a subset of Java SE accessible data. The vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets, or through APIs in the specified component (Oracle CPU).

The vulnerability requires network access via multiple protocols and human interaction from a person other than the attacker for successful exploitation. It can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs without using sandboxed applications (Oracle CPU).

Oracle released patches for affected versions as part of the October 2020 Critical Patch Update. Users should upgrade to the patched versions: Java SE 7u271, 8u272, 11.0.9, or newer versions. For systems running OpenJDK, updates are available through various distributions including Red Hat (Red Hat Advisory) and Debian (Debian Advisory).