SUSE CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

CVE-2021-21374: Use of Less Trusted Source

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

PT-2021-14456

Name of the Vulnerable Software and Affected Versions Nim versions prior to 1.2.10 Nim versions prior to 1.4.4 Description The issue affects the Nimble package manager for the Nim programming language. When "nimble refresh" is used, it fetches a list of Nimble packages over HTTPS by default, but...

CVE-2021-21373: Use of Less Trusted Source

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

PT-2021-8044

Name of the Vulnerable Software and Affected Versions Nimble versions prior to 1.2.10 Nimble versions prior to 1.4.4 Description The issue is related to the nimble refresh function of the Nimble package manager for the Nim programming language. It is caused by the lack of verification of download...