PT-2023-12595 · Nim+2 · Nim+2

Araq · Published 2023-01-13 · Updated 2023-06-03 · CVE-2021-46872

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nim versions prior to 1.6.2 NimForum versions prior to 2.2.0

Description An issue in the RST module of the Nim language stdlib allows the javascript: URI scheme, potentially leading to XSS in some applications.

Recommendations For Nim versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. For NimForum versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the RST module in the Nim language stdlib until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1935

CVE-2021-46872

Affected Products

Debian

Nim

Nimforum

References · 18

• https://github.com/nim-lang/Nim/pull/19134 · Patch
• https://github.com/nim-lang/Nim/commit/46275126b89218e64844eee169e8ced05dd0e2d7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-46872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46872 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/nim · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46872 · Vendor Advisory
• https://forum.nim-lang.org/t/8852 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-46872 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46872 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-46872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46872 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-46872 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1935 · Vendor Advisory
• https://github.com/nim-lang/Nim/compare/v1.6.0...v1.6.2 · Note
• https://github.com/nim-lang/nimforum · Note