PT-2021-14456 · Nimble+3 · Nimble+3

Tintinweb · Published 2021-03-26 · Updated 2024-06-15 · CVE-2021-21373

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Nim versions prior to 1.2.10 Nim versions prior to 1.4.4

Description The issue affects the Nimble package manager for the Nim programming language. When "nimble refresh" is used, it fetches a list of Nimble packages over HTTPS by default, but falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json in case of an error. An attacker able to perform a Man-in-the-Middle (MitM) attack can deliver a modified package list containing malicious software packages. If these packages are installed and used, the attack can escalate to untrusted code execution.

Recommendations For versions prior to 1.2.10, update to version 1.2.10 or later to resolve the issue. For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of the http://irclogs.nim-lang.org/packages.json URL until a patch is available. Restrict access to the "nimble refresh" command to minimize the risk of exploitation. Avoid using the non-TLS URL in the "nimble refresh" command until the issue is resolved.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-348

CWE-295

Related Identifiers

ALT-PU-2021-1770

CVE-2021-21373

GHSA-8W52-R35X-RGP8

OPENSUSE-SU-2021:0618-1

OPENSUSE-SU-2021:0628-1

OPENSUSE-SU-2021_0618-1

OPENSUSE-SU-2022:10095-1

OPENSUSE-SU-2022:10101-1

OPENSUSE-SU-2024:11093-1

Affected Products

Alt Linux

Nim

Nimble

Suse

References · 41

• 🔥 https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21373 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11093-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0618-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21373 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21373 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21373 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10095-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10101-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21373 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21373 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0628-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21373 · Security Note
• https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130 · Note
• https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8 · Note