Approved changes feed: RSS · Atom
cpe:2.3:a:nim-lang:security:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nim Lang (43225b88-c491-57f8-8598-b27f35d0c2d2) |
|---|---|
| Product | Security (c6bd726b-be0c-54ee-a11a-a7b5d3885a65) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-29495 |
vulnerable | 2026-06-08 05:31:26.464409 |
Nim stdlib httpClient does not validate peer certificates by default
MEDIUM (5.9)
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented.
Published: 2021-05-07T15:15:10.000Z
Updated: 2024-08-03T22:11:05.438Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21374 |
vulnerable | 2026-06-08 05:29:11.771479 |
Nimble fails to validate certificates due to insecure httpClient defaults
HIGH (8.1)
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
Published: 2021-03-26T21:25:14.000Z
Updated: 2024-08-03T18:09:15.923Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21373 |
vulnerable | 2026-06-08 05:29:11.771037 |
Nimble falls back to insecure http url when fetching packages
HIGH (7.5)
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
Published: 2021-03-26T21:25:19.000Z
Updated: 2024-08-03T18:09:15.923Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21372 |
vulnerable | 2026-06-08 05:29:11.769541 |
Nimble arbitrary code execution for specially crafted package metadata
HIGH (8.3)
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
Published: 2021-03-26T21:20:15.000Z
Updated: 2024-08-03T18:09:15.920Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.