CVE-2021-20304: 
NixOS vulnerability analysis and mitigation

A flaw was discovered in OpenEXR's hufDecode functionality (CVE-2021-20304) that allows an attacker who can pass a crafted file to trigger an undefined right shift error. The vulnerability affects OpenEXR versions up to and including 2.5.7 (NVD).

The vulnerability exists in the hufDecode function of IlmImf/ImfHuf.cpp, where if lc < 0, the getCode macro function could perform an undefined bitwise right shift. The lc value is controllable via the input buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, Bugzilla).

The highest threat from this vulnerability is to system availability. When OpenEXR processes a crafted input file, the undefined shift behavior could potentially lead to an impact on application availability (NVD, Bugzilla).

The vulnerability was fixed in OpenEXR 3.0.0-beta with a patch that adds validation checks for Huf code lengths. The fix involves checking for negative lc values before performing the shift operation (GitHub Patch). Users are advised to upgrade to a version that includes this fix.