deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1627
Published: 2021-03-26
Description: MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://help.salesforce.com/articleView?id=000357383&type=1&mode=1; https://help.salesforce.com/articleView?id=000357383&type=1&mode=1
CVE: CVE-2021-1628
Published: 2021-03-26
Description: MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://help.salesforce.com/articleView?id=000357384&type=1&mode=1; https://help.salesforce.com/articleView?id=000357384&type=1&mode=1
CVE: CVE-2021-1629
Published: 2021-03-26
Description: Tableau Server fails to validate certain URLs that are embedded in emails sent to Tableau Server users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://packetstormsecurity.com/files/162138/Tableau-Server-Open-Redirection.html; http://seclists.org/fulldisclosure/2021/Apr/22; https://help.salesforce.com/articleView?id=000357424&type=1&mode=1
CVE: CVE-2021-20193
Published: 2021-03-26
Description: A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-125, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1917565; https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d[PII_REDACTED]fa8ff68e1b1a473d187cc3fd777; https://savannah.gnu.org/bugs/?59897
CVE: CVE-2021-20197
Published: 2021-03-26
Description: There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59, CWE-59, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=1913743; https://security.gentoo.org/glsa/202208-30; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20271
Published: 2021-03-26
Description: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-345, CWE-345
References: https://bugzilla.redhat.com/show_bug.cgi?id=1934125; https://github.com/rpm-software-management/rpm/commit/d6a86b5e69e46cc283b1e06c92343319beb42e21; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/
CVE: CVE-2021-20284
Published: 2021-03-26
Description: A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1937784; https://security.gentoo.org/glsa/202208-30; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-20285
Published: 2021-03-26
Description: A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via a crafted ELF. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1937787; https://github.com/upx/upx/issues/421; https://bugzilla.redhat.com/show_bug.cgi?id=1937787
CVE: CVE-2021-20289
Published: 2021-03-26
Description: A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://bugzilla.redhat.com/show_bug.cgi?id=1935927; https://www.oracle.com/security-alerts/cpuapr2022.html; https://bugzilla.redhat.com/show_bug.cgi?id=1935927
CVE: CVE-2020-28695
Published: 2021-03-26
Description: Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b; https://cr1pt0.medium.com/cve-2020-28695-8f8d618ac0b
CVE: CVE-2021-21403
Published: 2021-03-26
Description: In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-305, CWE-287
References: https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1; https://github.com/kongchuanhujiao/server/security/advisories/GHSA-8wrg-m8vm-5fvj; https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1
CVE: CVE-2021-29255
Published: 2021-03-26
Description: MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as the device can capture these credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://blog.microseven.com; https://cybergladius.com/cve-2021-29255-vulnerability-disclosure/; https://blog.microseven.com
CVE: CVE-2021-22886
Published: 2021-03-26
Description: Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.rocket.chat/guides/security/security-updates; https://github.com/RocketChat/Rocket.Chat/pull/20430; https://hackerone.com/reports/1014459
CVE: CVE-2021-25369
Published: 2021-03-26
Description: An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25370
Published: 2021-03-26
Description: An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-416, CWE-703
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25371
Published: 2021-03-26
Description: A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-912
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-25372
Published: 2021-03-26
Description: An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787, CWE-703
References: https://security.samsungmobile.com; https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com
CVE: CVE-2021-21332
Published: 2021-03-26
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df; https://github.com/matrix-org/synapse/pull/9200; https://github.com/matrix-org/synapse/releases/tag/v1.27.0
CVE: CVE-2021-21333
Published: 2021-03-26
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/matrix-org/synapse/commit/e54746bdf7d5c831eabe4dcea76a7626f1de73df; https://github.com/matrix-org/synapse/pull/9200; https://github.com/matrix-org/synapse/releases/tag/v1.27.0
CVE: CVE-2021-22172
Published: 2021-03-26
Description: Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22172.json; https://gitlab.com/gitlab-org/gitlab/-/issues/212911; https://hackerone.com/reports/833334
CVE: CVE-2021-22180
Published: 2021-03-26
Description: An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22180.json; https://gitlab.com/gitlab-org/gitlab/-/issues/295662; https://hackerone.com/reports/1064645
CVE: CVE-2021-22184
Published: 2021-03-26
Description: An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22184.json; https://gitlab.com/gitlab-org/gitlab/-/issues/281676; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22184.json
CVE: CVE-2021-22194
Published: 2021-03-26
Description: In all versions of GitLab, marshalled session keys were being stored in Redis.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-312
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22194.json; https://gitlab.com/gitlab-org/gitlab/-/issues/262107; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22194.json
CVE: CVE-2020-25578
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-665
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc
CVE: CVE-2020-25579
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-909
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc
CVE: CVE-2020-25580
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:03.pam_login_access.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:03.pam_login_access.asc
CVE: CVE-2020-25581
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc
CVE: CVE-2020-25582
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed.
CVSS Score: 8.7 (HIGH)
CWE: CWE-362
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc
CVE: CVE-2020-7461
Published: 2021-03-26
Description: In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-288459.pdf; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:26.dhclient.asc; https://cert-portal.siemens.com/productcert/pdf/ssa-288459.pdf
CVE: CVE-2020-7462
Published: 2021-03-26
Description: In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending IPv6 Hop-by-Hop options over the loopback interface. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:24.ipv6.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:24.ipv6.asc
CVE: CVE-2020-7463
Published: 2021-03-26
Description: In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2021/Apr/49; http://seclists.org/fulldisclosure/2021/Apr/50; http://seclists.org/fulldisclosure/2021/Apr/57
CVE: CVE-2020-7464
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming error in the ure(4) device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret part of the payload of a large packet as a separate packet, and thereby inject packets across security boundaries such as VLANs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:27.ure.asc
CVE: CVE-2020-7467
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped.
CVSS Score: 7.6 (HIGH)
CWE: CWE-269
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:29.bhyve_svm.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:29.bhyve_svm.asc
CVE: CVE-2020-7468
Published: 2021-03-26
Description: In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a ftpd(8) bug in the implementation of the file system sandbox, combined with capabilities available to an authenticated FTP user, can be used to escape the file system restriction configured in ftpchroot(5). Moreover, the bug allows a malicious client to gain root privileges.
CVSS Score: 8.8 (HIGH)
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:30.ftpd.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:30.ftpd.asc
CVE: CVE-2021-21389
Published: 2021-03-26
Description: BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://buddypress.org/2021/03/buddypress-7-2-1-security-release/; https://codex.buddypress.org/releases/version-7-2-1/; https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3
CVE: CVE-2021-21411
Published: 2021-03-26
Description: OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-Groups` header to the upstream application. While adding GitLab project based authorization support in #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group` config entries instead of pulling the individual user's group membership from the GitLab Userinfo endpoint. When the session groups where compared against the allowed groups for authorization, they matched improperly (since both lists were populated with the same data) so authorization was allowed. This impacts GitLab Provider users who relies on group membership for authorization restrictions. Any authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group` membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug. But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups; it is not broken.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://docs.gitlab.com/ee/user/group/; https://github.com/oauth2-proxy/oauth2-proxy/commit/0279fa7dff1752f1710707dbd1ffac839de8bbfc; https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.1.0
CVE: CVE-2021-20206
Published: 2021-03-26
Description: An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=1919391; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549; https://bugzilla.redhat.com/show_bug.cgi?id=1919391
CVE: CVE-2021-21372
Published: 2021-03-26
Description: Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-74, CWE-78
References: https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/; https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130; https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
CVE: CVE-2021-21373
Published: 2021-03-26
Description: Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-348, CWE-295
References: https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/; https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130; https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8