CVE-2021-21374highCWE-348CWE-349CWE-599

CVE-2021-21374: falha de alta gravidade em nim-lang security

Nimble fails to validate certificates due to insecure httpClient defaults

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security+ Monitorar nim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.0%
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
Produtos afetados
nim-lang · security
CVEs relacionadas — nim-lang security

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21372HIGHNimble arbitrary code execution for specially crafted package metadataEPSS 3.6%CVE-2021-21373HIGHNimble falls back to insecure http url when fetching packagesEPSS 1.2%CVE-2021-29495MEDIUMNim stdlib httpClient does not validate peer certificates by defaultEPSS 0.5%