Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10101-1 advisory.

  - In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a     newline character. (CVE-2020-15690)

  - In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser.
    This argument can be a local file path that will be opened in the default explorer. An attacker can pass     one argument to the underlying open command to execute arbitrary registered system commands.
    (CVE-2020-15692)

  - In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An     injection is possible if the attacker controls any part of the URL provided in a call (such as     httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.
    (CVE-2020-15693)

  - In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example,     httpClient.get().contentLength() does not raise any error if a malicious server provides a negative     Content-Length. (CVE-2020-15694)

  - Nimble is a package manager for the Nim programming language. In Nim release version before versions     1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary     commands. An attacker can craft a malicious entry in the packages.json package list to trigger code     execution. (CVE-2021-21372)

  - Nimble is a package manager for the Nim programming language. In Nim release versions before versions     1.2.10 and 1.4.4, nimble refresh fetches a list of Nimble packages over HTTPS by default. In case of     error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to     perform MitM can deliver a modified package list containing malicious software packages. If the packages     are installed and used the attack escalates to untrusted code execution. (CVE-2021-21373)

  - Nimble is a package manager for the Nim programming language. In Nim release versions before versions     1.2.10 and 1.4.4, nimble refresh fetches a list of Nimble packages over HTTPS without full verification     of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can     deliver a modified package list containing malicious software packages. If the packages are installed and     used the attack escalates to untrusted code execution. (CVE-2021-21374)

  - Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2,     httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to     receive a patch or, as a workaround, set verifyMode = CVerifyPeer as documented. (CVE-2021-29495)

  - Nim is a systems programming language with a focus on efficiency, expressiveness, and elegance. In     affected versions the uri.parseUri function which may be used to validate URIs accepts null bytes in the     input URI. This behavior could be used to bypass URI validation. For example:
    parseUri(http://localhost\0hello).hostname is set to localhost\0hello. Additionally,     httpclient.getContent accepts null bytes in the input URL and ignores any data after the first null byte.
    Example: getContent(http://localhost\0hello) makes a request to localhost:80. An attacker can use a null     bytes to bypass the check and mount a SSRF attack. (CVE-2021-41259)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nim fixes the following issues :

num was updated to version 1.2.12 :

  - Fixed GC crash resulting from inlining of the memory     allocation procs

  - Fixed &ldquo;incorrect raises effect for     $(NimNode)&rdquo; (#17454)

From version 1.2.10 :

  - Fixed &ldquo;JS backend doesn&rsquo;t handle float->int     type conversion &ldquo; (#8404)

  - Fixed &ldquo;The &ldquo;try except&rdquo; not work when     the &ldquo;OSError: Too many open files&rdquo; error     occurs!&rdquo; (#15925)

  - Fixed &ldquo;Nim emits #line 0 C preprocessor directives     with &ndash;debugger:native, with ICE in gcc-10&rdquo;
    (#15942)

  - Fixed &ldquo;tfuturevar fails when activated&rdquo;
    (#9695)

  - Fixed &ldquo;nre.escapeRe is not gcsafe&rdquo; (#16103)

  - Fixed &ldquo;&ldquo;Error: internal error:
    genRecordFieldAux&rdquo; - in the     &ldquo;version-1-4&rdquo; branch&rdquo; (#16069)

  - Fixed &ldquo;-d:fulldebug switch does not compile with     gc:arc&rdquo; (#16214)

  - Fixed &ldquo;osLastError may randomly raise defect and     crash&rdquo; (#16359)

  - Fixed &ldquo;generic importc proc&rsquo;s don&rsquo;t     work (breaking lots of vmops procs for js)&rdquo;
    (#16428)

  - Fixed &ldquo;Concept: codegen ignores parameter     passing&rdquo; (#16897)

  - Fixed &ldquo;(.push exportc.) interacts with anonymous     functions&rdquo; (#16967)

  - Fixed &ldquo;memory allocation during (.global.) init     breaks GC&rdquo; (#17085)

  - Fixed 'Nimble arbitrary code execution for specially     crafted package metadata'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-rg9f-w24h-962p

  + (boo#1185083, CVE-2021-21372)

  - Fixed 'Nimble falls back to insecure http url when     fetching packages'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-8w52-r35x-rgp8

  + (boo#1185084, CVE-2021-21373)

  - Fixed 'Nimble fails to validate certificates due to     insecure httpClient defaults'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-c2wm-v66h-xhxx

  + (boo#1185085, CVE-2021-21374)

from version 1.2.8

  - Fixed &ldquo;Defer and &ndash;gc:arc&rdquo; (#15071)

  - Fixed &ldquo;Issue with &ndash;gc:arc at compile     time&rdquo; (#15129)

  - Fixed &ldquo;Nil check on each field fails in generic     function&rdquo; (#15101)

  - Fixed &ldquo;[strscans] scanf doesn&rsquo;t match a     single character with $+ if it&rsquo;s the end of the     string&rdquo; (#15064)

  - Fixed &ldquo;Crash and incorrect return values when     using readPasswordFromStdin on Windows.&rdquo; (#15207)

  - Fixed &ldquo;Inconsistent unsigned -> signed RangeDefect     usage across integer sizes&rdquo; (#15210)

  - Fixed &ldquo;toHex results in RangeDefect exception when     used with large uint64&rdquo; (#15257)

  - Fixed &ldquo;Mixing &lsquo;return&rsquo; with     expressions is allowed in 1.2&rdquo; (#15280)

  - Fixed &ldquo;proc execCmdEx doesn&rsquo;t work with
    -d:useWinAnsi&rdquo; (#14203)

  - Fixed &ldquo;memory corruption in tmarshall.nim&rdquo;
    (#9754)

  - Fixed &ldquo;Wrong number of variables&rdquo; (#15360)

  - Fixed &ldquo;defer doesnt work with block, break and     await&rdquo; (#15243)

  - Fixed &ldquo;Sizeof of case object is incorrect.
    Showstopper&rdquo; (#15516)

  - Fixed &ldquo;Mixing &lsquo;return&rsquo; with     expressions is allowed in 1.2&rdquo; (#15280)

  - Fixed &ldquo;regression(1.0.2 => 1.0.4) VM register     messed up depending on unrelated context&rdquo; (#15704)

from version 1.2.6

  - Fixed &ldquo;The pegs module doesn&rsquo;t work with     generics!&rdquo; (#14718)

  - Fixed &ldquo;[goto exceptions] (.noReturn.) pragma is     not detected in a case expression&rdquo; (#14458)

  - Fixed &ldquo;[exceptions:goto] C compiler error with     dynlib pragma calling a proc&rdquo; (#14240)

  - Fixed &ldquo;Nim source archive install:
    &lsquo;install.sh&rsquo; fails with error: cp: cannot     stat &lsquo;bin/nim-gdb&rsquo;: No such file or     directory&rdquo; (#14748)

  - Fixed &ldquo;Stropped identifiers don&rsquo;t work as     field names in tuple literals&rdquo; (#14911)

  - Fixed &ldquo;uri.decodeUrl crashes on incorrectly     formatted input&rdquo; (#14082)

  - Fixed &ldquo;odbcsql module has some wrong integer     types&rdquo; (#9771)

  - Fixed &ldquo;[ARC] Compiler crash declaring a finalizer     proc directly in &lsquo;new&rsquo;&rdquo; (#15044)

  - Fixed &ldquo;code with named arguments in proc of     winim/com can not been compiled&rdquo; (#15056)

  - Fixed &ldquo;javascript backend produces JavaScript code     with syntax error in object syntax&rdquo; (#14534)

  - Fixed &ldquo;[ARC] SIGSEGV when calling a closure as a     tuple field in a seq&rdquo; (#15038)

  - Fixed &ldquo;Compiler crashes when using string as     object variant selector with else branch&rdquo; (#14189)

  - Fixed &ldquo;Constructing a uint64 range on a 32-bit     machine leads to incorrect codegen&rdquo; (#14616)

Update to version 1.2.2 :

  - See https://nim-lang.org/blog.html for details

Update to version 1.0.2 :

  - See https://nim-lang.org/blog.html for details

ID	Name	Product	Family	Severity
164473	openSUSE 15 Security Update : nim (openSUSE-SU-2022:10101-1)	Nessus	SuSE Local Security Checks	critical
149589	openSUSE Security Update : nim (openSUSE-2021-618)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-21373

medium

Tenable Plugins

critical

high