CVE-2021-21372highCWE-20CWE-74

CVE-2021-21372: falha de alta gravidade em nim-lang security

Nimble arbitrary code execution for specially crafted package metadata

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security+ Monitorar nim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 3.6%
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
nim-lang · security
CVEs relacionadas — nim-lang security

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21373HIGHNimble falls back to insecure http url when fetching packagesEPSS 1.2%CVE-2021-21374HIGHNimble fails to validate certificates due to insecure httpClient defaultsEPSS 1.0%CVE-2021-29495MEDIUMNim stdlib httpClient does not validate peer certificates by defaultEPSS 0.5%