Vulnerability Details : CVE-2021-21374
Potential exploit
Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.
Products affected by CVE-2021-21374
- cpe:2.3:a:nim-lang:nim:*:*:*:*:*:*:*:*
- cpe:2.3:a:nim-lang:nim:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-21374
0.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-21374
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L |
2.2
|
5.3
|
GitHub, Inc. |
CWE ids for CVE-2021-21374
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
-
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.Assigned by: security-advisories@github.com (Secondary)
-
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.Assigned by: security-advisories@github.com (Secondary)
-
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2021-21374
-
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
nimble/changelog.markdown at master · nim-lang/nimble · GitHubRelease Notes;Third Party Advisory
-
https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx
Nimble fails to validate certificates due to insecure httpClient defaults · Advisory · nim-lang/security · GitHubThird Party Advisory
-
https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
Nim - Insecure SSL/TLS Defaults, MitM, and nimble shell command injection | ConsenSys DiligenceExploit;Third Party Advisory
-
https://github.com/nim-lang/Nim/pull/16940
basic cleanups regarding SSL handling by Araq · Pull Request #16940 · nim-lang/Nim · GitHubPatch;Third Party Advisory
Jump to