Lucene search

[email protected]CVE-2021-21374

HistoryMar 26, 2021 - 10:15 p.m.

CVE-2021-21374

2021-03-2622:15:12

CWE-295

CWE-599

CWE-349

CWE-348

[email protected]

web.nvd.nist.gov

160

cve-2021-21374

nimble

package manager

nim

programming language

mitm

ssl/tls

certificate

untrusted code execution

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, “nimble refresh” fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

Affected configurations

Vulners

NVD

Node

nim-langnim-langRange<1.2.10

nim-langnim-langRange1.4.0–1.4.4

VendorProductVersionCPE
nim\-langnim\-lang*cpe:2.3:a:nim\-lang:nim\-lang:*:*:*:*:*:*:*:*
nim\-langnim\-lang*cpe:2.3:a:nim\-lang:nim\-lang:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nim\-lang	nim\-lang	*	cpe:2.3:a:nim\-lang:nim\-lang::::::::
nim\-lang	nim\-lang	*	cpe:2.3:a:nim\-lang:nim\-lang::::::::

CNA Affected

[
  {
    "product": "security",
    "vendor": "nim-lang",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.2.10"
      },
      {
        "status": "affected",
        "version": ">= 1.4.0, < 1.4.4"
      }
    ]
  }
]