CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults

High 8.1 Published 26 Mar 2021 Updated 3 Aug 2024

Nimble package manager fails to validate SSL certificates by default, allowing Man-in-the-Middle attackers to inject malicious packages leading to code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-21374?

CVE-2021-21374 is a high-severity vulnerability in nim-lang security, published on 26 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

Weakness: CWE-295, CWE-599, CWE-349, CWE-348

Which versions are affected by CVE-2021-21374?

It affects 1 product.

Products include Nim-Lang Nim.

How do I fix CVE-2021-21374?

Upgrade to a fixed version.

Is CVE-2021-21374 being exploited?

There is no known exploitation of CVE-2021-21374 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2021-21374, GHSA-c2wm-v66h-xhxx, UBUNTU-CVE-2021-21374.