CVE-2021-21372highCWE-20 CWE-74

Nimble arbitrary code execution for specially crafted package metadata

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.3epss 3.6%

probabilidad de explotación

3.6%top 12% de las CVE

explotación observada

noninguna fuente lo reporta

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Productos afectados

nim-lang · security

Referencias

https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130 https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37 https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p