CVE-2020-36325: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Jansson through version 2.13.1, identified as CVE-2020-36325. The vulnerability stems from a parsing error in the json_loads function, which results in an out-of-bounds read-access bug (NVD, Ubuntu).

The vulnerability manifests as an out-of-bounds read memory corruption bug in the string_get function within the src/load.c file. The issue specifically occurs during JSON parsing operations when using the json_loads function, as demonstrated through fuzzing tests (Github Issue).

The vulnerability could lead to memory corruption through out-of-bounds read access, potentially causing application crashes or unexpected behavior when parsing malformed JSON input (NVD).

The vulnerability has been demonstrated through fuzzing tests, showing that it can be triggered by specially crafted JSON input. The issue was initially discovered and reported through security research efforts (Github Issue).

The vulnerability affects Jansson through version 2.13.1, and users are advised to update to newer versions of the library when available (Debian Tracker).

The vulnerability has been noted in various security tracking systems, including Debian's security tracker where it is marked as vulnerable across multiple distributions. The issue has also been discussed in the context of container security, particularly affecting components like kube-proxy (Kubernetes Discussion).