CVE-2021-21374

Name of the Vulnerable Software and Affected Versions Nimble versions prior to 1.2.10 Nimble versions prior to 1.4.4

Description The issue is related to the nimble refresh function of the Nimble package manager for the Nim programming language. It is caused by the lack of verification of downloaded packages due to an error in the certificate authentication procedure. This can allow a remote attacker to perform a man-in-the-middle attack or execute arbitrary code by downloading malicious packages.

Recommendations For Nimble versions prior to 1.2.10, update to version 1.2.10 or later to resolve the issue. For Nimble versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the nimble refresh function until a patch is available. Restrict access to the httpClient to minimize the risk of exploitation.