CVE-2021-21373
High
Description
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNim
PublishedMar 26, 2021
First seenMar 26, 2021
Weakness typeCWE-348CWE-348
How to fix
Update
- nim-lang nim1.2.10, 1.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nim-lang nim | v < 1.2.10, 1.4.0 ≤ v < 1.4.4 | 1.2.10, 1.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.