CVE-2020-27823: 
NixOS vulnerability analysis and mitigation

A flaw was discovered in OpenJPEG's encoder (CVE-2020-27823) that allows an attacker to pass specially crafted x,y offset input to OpenJPEG during encoding operations. The vulnerability was identified in OpenJPEG versions prior to 2.4.0 and affects multiple operating systems including Debian and Fedora distributions (NVD, Debian Security).

The vulnerability is classified as a heap buffer overflow write vulnerability in the opj_tcd_dc_level_shift_encode() function. It occurs specifically when processing crafted input with the -d option during encoding operations. The vulnerability has received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability poses significant risks to system security, with high potential impact on confidentiality, integrity, and system availability. When successfully exploited, it could lead to denial of service or potentially allow arbitrary code execution when processing malformed images (Debian LTS).

The vulnerability requires local access and user interaction to exploit, specifically when using the encoder functionality with the -d option. Red Hat Product Security rated this flaw with Moderate severity as it specifically affects the encoder functionality during image conversion rather than general image file reading operations (Red Hat Bugzilla).

The vulnerability has been fixed in OpenJPEG version 2.4.0. Various distributions have released security updates: Debian 10 (buster) fixed in version 2.3.0-2+deb10u2, Debian 9 (stretch) in version 2.1.2-1.1+deb9u6, and Fedora in version 2.3.1-9.fc33. As a workaround before applying patches, users are advised not to use OpenJPEG to convert untrusted image files (Debian Security, Fedora Update).