CVE-2021-21373
Summary
| CVE | CVE-2021-21373 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-03-26 22:15:00 UTC |
| Updated | 2021-03-31 15:52:00 UTC |
| Description | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution. |
Risk And Classification
Problem Types: CWE-295
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| nimble/changelog.markdown at master · nim-lang/nimble · GitHub | MISC | github.com | |
| Nimble falls back to insecure http url when fetching packages · Advisory · nim-lang/security · GitHub | CONFIRM | github.com | |
| Nim - Insecure SSL/TLS Defaults, MitM, and nimble Remote Code Execution | ConsenSys Diligence | MISC | consensys.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.