CVE-2020-14798: 
NixOS vulnerability analysis and mitigation

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) affecting versions Java SE: 7u271, 8u261, 11.0.8, 15 and Java SE Embedded: 8u261. This vulnerability was discovered by Markus Loewe and disclosed in October 2020 (Oracle CPU).

The vulnerability is difficult to exploit and requires human interaction from a person other than the attacker. It involves incorrect length checking of input strings that could allow an unauthenticated attacker with network access via multiple protocols to compromise Java SE. The vulnerability has a CVSS 3.1 Base Score of 3.1 (LOW) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE and Java SE Embedded accessible data. The vulnerability primarily affects Java deployments that load and run untrusted code (e.g., code from the internet) and rely on the Java sandbox for security (NVD).

The vulnerability is considered difficult to exploit and requires human interaction. It affects Java deployments that typically run sandboxed Java Web Start applications or sandboxed Java applets. The vulnerability does not apply to Java deployments that only load and run trusted code, such as those typically found in servers (NVD).

Oracle released patches as part of their October 2020 Critical Patch Update. Users should upgrade to the fixed versions: Java SE 7u272, 8u262, 11.0.9, or 15.0.1. For Linux distributions, specific package updates are available: Ubuntu users should update to openjdk-8-jdk version 8u272-b10 (Ubuntu Notice), Debian users should update to version 8u272-b10-0+deb9u1 (Debian Advisory), and OpenSUSE users should update to java-1_8_0-openj9 version 8u272 (OpenSUSE Advisory).