Upstream information
Description
Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 6.8 |
Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
National Vulnerability Database | |
---|---|
Base Score | 8.8 |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | None |
User Interaction | Required |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- openSUSE-SU-2021:0618-1, published Mon Apr 26 00:40:32 2021
- openSUSE-SU-2021:0628-1, published Thu Apr 29 21:39:36 2021
- openSUSE-SU-2022:10095-1, published Wed Aug 24 10:48:30 2022
- openSUSE-SU-2022:10101-1, published Sat Aug 27 18:50:23 2022
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Package Hub 15 SP2 |
| Patchnames: openSUSE-2021-628 |
SUSE Package Hub 15 SP3 |
| Patchnames: openSUSE-2022-10095 |
SUSE Package Hub 15 SP4 |
| Patchnames: openSUSE-2022-10101 |
openSUSE Leap 15.2 |
| Patchnames: openSUSE-2021-618 |
openSUSE Leap 15.3 |
| Patchnames: openSUSE-2022-10095 |
openSUSE Leap 15.4 |
| Patchnames: openSUSE-2022-10101 |
openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2024-11093 |
SUSE Timeline for this CVE
CVE page created: Sat Mar 27 16:53:02 2021CVE page last modified: Tue Sep 3 19:19:37 2024