CVE-2021-29495mediumCWE-295

CVE-2021-29495: falha de média gravidade em nim-lang security

Nim stdlib httpClient does not validate peer certificates by default

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar security+ Monitorar nim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.5%
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
nim-lang · security
CVEs relacionadas — nim-lang security

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21372HIGHNimble arbitrary code execution for specially crafted package metadataEPSS 3.6%CVE-2021-21373HIGHNimble falls back to insecure http url when fetching packagesEPSS 1.2%CVE-2021-21374HIGHNimble fails to validate certificates due to insecure httpClient defaultsEPSS 1.0%