CVE-2021-20307: 
NixOS vulnerability analysis and mitigation

CVE-2021-20307 is a format string vulnerability discovered in the libpano13 library, specifically affecting versions 2.9.20~rc2+dfsg-3 and earlier. The vulnerability exists in the panoFileOutputNamesCreate() function where unvalidated input is passed directly into the formatter (NVD, Gentoo Security).

The vulnerability is classified as a format string issue (CWE-134) where unvalidated input in the panoFileOutputNamesCreate() function is passed directly into the formatter. The CVSS v3.1 base score is 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level with network attack vector, low attack complexity, and no required privileges or user interaction (NVD).

The vulnerability can lead to read and write arbitrary memory values. If exploited, an attacker could potentially execute arbitrary code with the privileges of the process or cause a Denial of Service condition (Gentoo Security).

The vulnerability was fixed in libpano13 version 2.9.20, which prevents string vulnerability by refusing prefix strings with percentage signs. Users are advised to upgrade to version 2.9.20 or later. For Debian 9 stretch, the fix was implemented in version 2.9.19+dfsg-2+deb9u1 (Debian LTS, Sourceforge).