CVE-2020-28241: 
NixOS vulnerability analysis and mitigation

CVE-2020-28241 is a security vulnerability discovered in libmaxminddb, affecting versions before 1.4.3. The issue involves an improper initialization in the dump_entry_data_list() function in maxminddb.c, which could lead to a heap-based buffer over-read when processing specially crafted MaxMind DB files (Red Hat Portal, Ubuntu Security).

The vulnerability stems from a heap-based buffer over-read in the dump_entry_data_list() function within maxminddb.c. The specific issue occurs when the mmdblookup tool is used to open a specially crafted database file, where the code fails to properly null terminate strings when the size is zero. This was identified through AddressSanitizer testing which revealed a heap-buffer-overflow at address 0x6020000000d1 (GitHub Issue).

The vulnerability could allow an attacker to cause a Denial of Service condition by enticing a user to process a specially crafted database file. The issue has been assigned a CVSS base score of 6.5 (Medium severity) (Ubuntu Security, Gentoo Security).

The vulnerability can be triggered remotely by sending a specially crafted MaxMind DB file to a system using the affected versions of libmaxminddb. The exploitation requires user interaction in the form of processing the malicious database file (Red Hat Portal).

The vulnerability was fixed in libmaxminddb version 1.4.3. The fix involved replacing most malloc uses with calloc to ensure proper memory initialization. Users are advised to upgrade to version 1.4.3 or later. For systems that cannot immediately upgrade, there are no known workarounds (GitHub PR, Gentoo Security).