Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nimble is a package manager for the Nim programming language. In Nim release versions before versions     1.2.10 and 1.4.4, nimble refresh fetches a list of Nimble packages over HTTPS by default. In case of     error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to     perform MitM can deliver a modified package list containing malicious software packages. If the packages     are installed and used the attack escalates to untrusted code execution. (CVE-2021-21373)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10101-1 advisory.

    Includes upstream security fixes for:

    * (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a       CR-LF injection
    * (boo#1175334, CVE-2020-15692) mishandle of argument to       browsers.openDefaultBrowser
    * (boo#1175332, CVE-2020-15694) httpClient.get().contentLength()       fails to properly validate the server response
    * (boo#1192712, CVE-2021-41259) null byte accepted in getContent       function, leading to URI validation bypass
    * (boo#1185948, CVE-2021-29495) stdlib httpClient does not       validate peer certificates by default
    * (boo#1185085, CVE-2021-21374) Improper verification of the       SSL/TLS certificate
    * (boo#1185084, CVE-2021-21373) 'nimble refresh' falls back to a       non-TLS URL in case of error
    * (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute       arbitrary commands
    * (boo#1181705, CVE-2020-15690) Standard library asyncftpclient       lacks a check for newline character

    Update to 1.6.6

    * standard library use consistent styles for variable names so it       can be used in projects which force a consistent style with
      --styleCheck:usages option.
    * ARC/ORC are now considerably faster at method dispatching,       bringing its performance back on the level of the refc memory       management.
    * Full changelog:
      https://nim-lang.org/blog/2022/05/05/version-166-released.html
    - Previous updates and changelogs:
    * 1.6.4:
      https://nim-lang.org/blog/2022/02/08/version-164-released.html
    * 1.6.2:
      https://nim-lang.org/blog/2021/12/17/version-162-released.html
    * 1.6.0:
      https://nim-lang.org/blog/2021/10/19/version-160-released.html
    * 1.4.8:
      https://nim-lang.org/blog/2021/05/25/version-148-released.html
    * 1.4.6:
      https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html
    * 1.4.4:
      https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html
    * 1.4.2:
      https://nim-lang.org/blog/2020/12/01/version-142-released.html
    * 1.4.0:
      https://nim-lang.org/blog/2020/10/16/version-140-released.html

    update to 1.2.16

    * oids: switch from PRNG to random module
    * nimc.rst: fix table markup
    * nimRawSetjmp: support Windows
    * correctly enable chronos
    * bigints are not supposed to work on 1.2.x
    * disable nimpy
    * misc bugfixes
    * fixes a 'mixin' statement handling regression [backport:1.2

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nim fixes the following issues :

num was updated to version 1.2.12 :

  - Fixed GC crash resulting from inlining of the memory     allocation procs

  - Fixed &ldquo;incorrect raises effect for     $(NimNode)&rdquo; (#17454)

From version 1.2.10 :

  - Fixed &ldquo;JS backend doesn&rsquo;t handle float->int     type conversion &ldquo; (#8404)

  - Fixed &ldquo;The &ldquo;try except&rdquo; not work when     the &ldquo;OSError: Too many open files&rdquo; error     occurs!&rdquo; (#15925)

  - Fixed &ldquo;Nim emits #line 0 C preprocessor directives     with &ndash;debugger:native, with ICE in gcc-10&rdquo;
    (#15942)

  - Fixed &ldquo;tfuturevar fails when activated&rdquo;
    (#9695)

  - Fixed &ldquo;nre.escapeRe is not gcsafe&rdquo; (#16103)

  - Fixed &ldquo;&ldquo;Error: internal error:
    genRecordFieldAux&rdquo; - in the     &ldquo;version-1-4&rdquo; branch&rdquo; (#16069)

  - Fixed &ldquo;-d:fulldebug switch does not compile with     gc:arc&rdquo; (#16214)

  - Fixed &ldquo;osLastError may randomly raise defect and     crash&rdquo; (#16359)

  - Fixed &ldquo;generic importc proc&rsquo;s don&rsquo;t     work (breaking lots of vmops procs for js)&rdquo;
    (#16428)

  - Fixed &ldquo;Concept: codegen ignores parameter     passing&rdquo; (#16897)

  - Fixed &ldquo;(.push exportc.) interacts with anonymous     functions&rdquo; (#16967)

  - Fixed &ldquo;memory allocation during (.global.) init     breaks GC&rdquo; (#17085)

  - Fixed 'Nimble arbitrary code execution for specially     crafted package metadata'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-rg9f-w24h-962p

  + (boo#1185083, CVE-2021-21372)

  - Fixed 'Nimble falls back to insecure http url when     fetching packages'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-8w52-r35x-rgp8

  + (boo#1185084, CVE-2021-21373)

  - Fixed 'Nimble fails to validate certificates due to     insecure httpClient defaults'

  +     https://github.com/nim-lang/security/security/advisories     /GHSA-c2wm-v66h-xhxx

  + (boo#1185085, CVE-2021-21374)

from version 1.2.8

  - Fixed &ldquo;Defer and &ndash;gc:arc&rdquo; (#15071)

  - Fixed &ldquo;Issue with &ndash;gc:arc at compile     time&rdquo; (#15129)

  - Fixed &ldquo;Nil check on each field fails in generic     function&rdquo; (#15101)

  - Fixed &ldquo;[strscans] scanf doesn&rsquo;t match a     single character with $+ if it&rsquo;s the end of the     string&rdquo; (#15064)

  - Fixed &ldquo;Crash and incorrect return values when     using readPasswordFromStdin on Windows.&rdquo; (#15207)

  - Fixed &ldquo;Inconsistent unsigned -> signed RangeDefect     usage across integer sizes&rdquo; (#15210)

  - Fixed &ldquo;toHex results in RangeDefect exception when     used with large uint64&rdquo; (#15257)

  - Fixed &ldquo;Mixing &lsquo;return&rsquo; with     expressions is allowed in 1.2&rdquo; (#15280)

  - Fixed &ldquo;proc execCmdEx doesn&rsquo;t work with
    -d:useWinAnsi&rdquo; (#14203)

  - Fixed &ldquo;memory corruption in tmarshall.nim&rdquo;
    (#9754)

  - Fixed &ldquo;Wrong number of variables&rdquo; (#15360)

  - Fixed &ldquo;defer doesnt work with block, break and     await&rdquo; (#15243)

  - Fixed &ldquo;Sizeof of case object is incorrect.
    Showstopper&rdquo; (#15516)

  - Fixed &ldquo;Mixing &lsquo;return&rsquo; with     expressions is allowed in 1.2&rdquo; (#15280)

  - Fixed &ldquo;regression(1.0.2 => 1.0.4) VM register     messed up depending on unrelated context&rdquo; (#15704)

from version 1.2.6

  - Fixed &ldquo;The pegs module doesn&rsquo;t work with     generics!&rdquo; (#14718)

  - Fixed &ldquo;[goto exceptions] (.noReturn.) pragma is     not detected in a case expression&rdquo; (#14458)

  - Fixed &ldquo;[exceptions:goto] C compiler error with     dynlib pragma calling a proc&rdquo; (#14240)

  - Fixed &ldquo;Nim source archive install:
    &lsquo;install.sh&rsquo; fails with error: cp: cannot     stat &lsquo;bin/nim-gdb&rsquo;: No such file or     directory&rdquo; (#14748)

  - Fixed &ldquo;Stropped identifiers don&rsquo;t work as     field names in tuple literals&rdquo; (#14911)

  - Fixed &ldquo;uri.decodeUrl crashes on incorrectly     formatted input&rdquo; (#14082)

  - Fixed &ldquo;odbcsql module has some wrong integer     types&rdquo; (#9771)

  - Fixed &ldquo;[ARC] Compiler crash declaring a finalizer     proc directly in &lsquo;new&rsquo;&rdquo; (#15044)

  - Fixed &ldquo;code with named arguments in proc of     winim/com can not been compiled&rdquo; (#15056)

  - Fixed &ldquo;javascript backend produces JavaScript code     with syntax error in object syntax&rdquo; (#14534)

  - Fixed &ldquo;[ARC] SIGSEGV when calling a closure as a     tuple field in a seq&rdquo; (#15038)

  - Fixed &ldquo;Compiler crashes when using string as     object variant selector with else branch&rdquo; (#14189)

  - Fixed &ldquo;Constructing a uint64 range on a 32-bit     machine leads to incorrect codegen&rdquo; (#14616)

Update to version 1.2.2 :

  - See https://nim-lang.org/blog.html for details

Update to version 1.0.2 :

  - See https://nim-lang.org/blog.html for details

ID	Name	Product	Family	Type	Severity
259282	Linux Distros Unpatched Vulnerability : CVE-2021-21373	Nessus	Misc.	Local	medium
164473	openSUSE 15 Security Update : nim (openSUSE-SU-2022:10101-1)	Nessus	SuSE Local Security Checks	Local	critical
149589	openSUSE Security Update : nim (openSUSE-2021-618)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2021-21373

medium

Tenable Plugins

medium

critical

high