CVE-2020-15694 Other in n/a
The Nim httpClient library fails to validate negative Content-Length headers, potentially causing denial of service when connecting to malicious servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15694?
CVE-2020-15694 is a high-severity vulnerability in n/a, published on 14 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
Weakness: CWE-20
Which versions are affected by CVE-2020-15694?
It affects 1 product.
Products include Nim-Lang Nim.
How do I fix CVE-2020-15694?
Upgrade to a fixed version.
Is CVE-2020-15694 being exploited?
There is no known exploitation of CVE-2020-15694 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-15690 Other in n/a
- CVE-2020-15692 Command injection in n/a
- CVE-2021-21372 Nimble arbitrary code execution for specially crafted package metadata
- CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults
- CVE-2021-21373 Nimble falls back to insecure http url when fetching packages
Sources
Also known as DEBIAN-CVE-2020-15694, GHSA-mwjr-9xqh-r2f5, UBUNTU-CVE-2020-15694.