CVE-2020-15693 Other in n/a
Attackers can inject CR-LF characters into HTTP requests via controlled URLs or headers in the Nim httpClient library, potentially leading to request smuggling or header injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15693?
CVE-2020-15693 is a medium-severity vulnerability in n/a, published on 14 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.
Weakness: CWE-74
Which versions are affected by CVE-2020-15693?
It affects 1 product.
Products include Nim-Lang Nim.
How do I fix CVE-2020-15693?
Upgrade to a fixed version.
Is CVE-2020-15693 being exploited?
There is no known exploitation of CVE-2020-15693 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-15690 Other in n/a
- CVE-2020-15692 Command injection in n/a
- CVE-2021-21372 Nimble arbitrary code execution for specially crafted package metadata
- CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults
- CVE-2021-21373 Nimble falls back to insecure http url when fetching packages
Sources
Also known as DEBIAN-CVE-2020-15693, UBUNTU-CVE-2020-15693.