CVE-2021-20302: 
NixOS vulnerability analysis and mitigation

A flaw was found in OpenEXR's TiledInputFile functionality that affects versions before 2.5.4. This vulnerability allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR to trigger a floating-point exception error (NIST NVD, Red Hat Bugzilla).

The vulnerability exists in the TiledInputFile functionality where a crafted single-part non-image file is not properly detected, potentially leading to a floating-point exception in methods such as precalculateTileInfot(). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NIST NVD).

The highest threat from this vulnerability is to system availability. When successfully exploited, it can cause a denial of service through a floating-point exception error, potentially leading to application crashes (NIST NVD, Red Hat Bugzilla).

The vulnerability has been fixed in OpenEXR version 2.5.4. Various distributions have released security updates to address this issue, including Debian which fixed it in version 2.2.1-4.1+deb10u2 (Debian Security). Users are recommended to upgrade to the patched versions.