CVE-2021-29473: 
NixOS vulnerability analysis and mitigation

CVE-2021-29473 affects Exiv2, a C++ library and command-line utility for reading, writing, deleting, and modifying image metadata. The vulnerability was discovered in versions v0.27.3 and earlier, and was disclosed in April 2021. The issue affects the Exiv2::Jp2Image::doWriteMetadata function when processing image files (GitHub Advisory).

The vulnerability is an out-of-bounds read in the Exiv2::Jp2Image::doWriteMetadata function. The issue is triggered when Exiv2 is used to write metadata into a crafted image file. The vulnerability has been assigned a CVSS v3.1 base score of 2.5 LOW with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L (NVD).

An attacker could potentially exploit this vulnerability to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The impact is limited since the bug is only triggered when writing metadata, which is a less frequently used Exiv2 operation than reading metadata (GitHub Advisory).

The vulnerability has been fixed in Exiv2 version v0.27.4. Users are advised to upgrade to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Debian (0.25-4+deb10u2), Fedora, and Red Hat Enterprise Linux (Debian Security, Red Hat).