CVE-2021-21372highCWE-20CWE-74

CVE-2021-21372: fallo de gravedad alta en nim-lang security

Nimble arbitrary code execution for specially crafted package metadata

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear security+ Monitorear nim

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 3.6%
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
nim-lang · security
CVEs relacionadas — nim-lang security

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-21373HIGHNimble falls back to insecure http url when fetching packagesEPSS 1.2%CVE-2021-21374HIGHNimble fails to validate certificates due to insecure httpClient defaultsEPSS 1.0%CVE-2021-29495MEDIUMNim stdlib httpClient does not validate peer certificates by defaultEPSS 0.5%