nim-1.2.12-1.7 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11093 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z nim-1.2.12-1.7 on GA media These are all security issues fixed in the nim-1.2.12-1.7 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11093 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11093 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-21372/ SUSE CVE CVE-2021-21372 page https://www.suse.com/security/cve/CVE-2021-21373/ SUSE CVE CVE-2021-21373 page https://www.suse.com/security/cve/CVE-2021-21374/ SUSE CVE CVE-2021-21374 page openSUSE Tumbleweed nim-1.2.12-1.7 nim-1.2.12-1.7 as a component of openSUSE Tumbleweed Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution. CVE-2021-21372 openSUSE Tumbleweed:nim-1.2.12-1.7 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21372.html CVE-2021-21372 https://bugzilla.suse.com/1185083 SUSE Bug 1185083 Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution. CVE-2021-21373 openSUSE Tumbleweed:nim-1.2.12-1.7 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21373.html CVE-2021-21373 https://bugzilla.suse.com/1185084 SUSE Bug 1185084 Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution. CVE-2021-21374 openSUSE Tumbleweed:nim-1.2.12-1.7 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21374.html CVE-2021-21374 https://bugzilla.suse.com/1185085 SUSE Bug 1185085