CVE-2021-21373highCWE-348

CVE-2021-21373: falha de alta gravidade em nim-lang security

Nimble falls back to insecure http url when fetching packages

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security+ Monitorar nim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.2%
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Produtos afetados
nim-lang · security
CVEs relacionadas — nim-lang security

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21372HIGHNimble arbitrary code execution for specially crafted package metadataEPSS 3.6%CVE-2021-21374HIGHNimble fails to validate certificates due to insecure httpClient defaultsEPSS 1.0%CVE-2021-29495MEDIUMNim stdlib httpClient does not validate peer certificates by defaultEPSS 0.5%