CVE-2021-21374
Assigner: GitHub_M
Published: 2021-03-26T21:25:14
State: PUBLISHED
affected: product: security
vendor: nim-lang
versions: status: affected
version: < 1.2.10
status: affected
version: >= 1.4.0, < 1.4.4
descriptions: value: Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
version: 3.1
problemTypes: descriptions: cweId: CWE-348
description: CWE-348 Use of Less Trusted Source
type: CWE
descriptions: cweId: CWE-599
description: CWE-599: Missing Validation of OpenSSL Certificate
type: CWE
descriptions: cweId: CWE-349
description: CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
type: CWE
source: advisory: GHSA-c2wm-v66h-xhxx
discovery: UNKNOWN
title: Nimble fails to validate certificates due to insecure httpClient defaults