CVE-2020-27845: 
NixOS vulnerability analysis and mitigation

There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability (NVD, MITRE).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) affecting the openjpeg library. The CVSS v3.1 base score is 5.5 (MEDIUM) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The flaw specifically affects the functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in the openjp2/pi.c file (Red Hat Bugzilla).

The vulnerability primarily affects application availability, with no direct impact on confidentiality or integrity. If successfully exploited, an attacker could cause a denial of service condition through an out-of-bounds read operation (NVD).

The vulnerability requires local access and user interaction to exploit. An attacker needs to provide specially crafted input to openjpeg's conversion/encoding functionality to trigger the out-of-bounds read condition (Red Hat Bugzilla).

The vulnerability has been fixed in openjpeg version 2.4.0. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Debian (DSA-4882-1), Fedora, and Gentoo (Debian Security, Gentoo Security).