CVE-2020-19860: 
NixOS vulnerability analysis and mitigation

A heap out-of-bounds read vulnerability was discovered in ldns version 1.7.1, specifically within the ldns_rr_new_frm_str_internal function when verifying a zone file. The vulnerability was disclosed on January 21, 2022, affecting the ldns library for DNS programming (NVD, Ubuntu Security).

The vulnerability occurs in the ldns_rr_new_frm_str_internal function when processing zone file data. The issue stems from improper input handling that could lead to a heap out-of-bounds read condition. The vulnerability was tracked as issue #70 in the ldns repository and was subsequently fixed with a patch that added additional buffer remaining checks (GitHub Commit).

The vulnerability could potentially allow an attacker to expose sensitive information through specially crafted inputs (Ubuntu Notice).

The issue has been addressed through security updates across various distributions. Ubuntu has released fixes for multiple versions: Ubuntu 22.04 (libldns3 - 1.7.1-2ubuntu4+esm1), Ubuntu 20.04 (libldns2 - 1.7.0-4.1ubuntu1+esm1), Ubuntu 18.04 (libldns2 - 1.7.0-3ubuntu4.1), and Ubuntu 16.04 (libldns1 - 1.6.17-8ubuntu0.1+esm1). Users are advised to perform a standard system update to apply the necessary patches (Ubuntu Notice).