CVE-2021-29495 Nim stdlib httpClient does not validate peer certificates by default
Nim's standard library HTTP client fails to validate SSL/TLS certificates by default, allowing man-in-the-middle attacks unless explicitly configured otherwise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29495?
CVE-2021-29495 is a medium-severity vulnerability in nim-lang security, published on 7 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented.
Weakness: CWE-295
Which versions are affected by CVE-2021-29495?
It affects 1 product.
Products include Nim-Lang Nim.
How do I fix CVE-2021-29495?
Upgrade to a fixed version.
Is CVE-2021-29495 being exploited?
There is no known exploitation of CVE-2021-29495 in the wild and no public exploit code.
Other vulnerabilities in nim-lang security
- CVE-2020-15690 Other in n/a
- CVE-2020-15692 Command injection in n/a
- CVE-2021-21372 Nimble arbitrary code execution for specially crafted package metadata
- CVE-2021-21374 Nimble fails to validate certificates due to insecure httpClient defaults
- CVE-2021-21373 Nimble falls back to insecure http url when fetching packages
Sources
Also known as DEBIAN-CVE-2021-29495, GHSA-9vqv-2jj9-7mqr, UBUNTU-CVE-2021-29495.