What is CVE-2021-21373?

CVE-2021-21373 is a high-severity vulnerability in Nim-lang Security, classified under CWE-348. CVSS score: 7.5/10. Published 2021-03-26.

How severe is CVE-2021-21373?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Nim-lang Security

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS U…

EPSS: 0.002 (40.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L.

Affected products

Nim-lang Security — versions < 1.2.10, >= 1.4.0, < 1.4.4

Weakness classification (CWE)

CWE-348

References

consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-co… (x_refsource_MISC)
github.com/nim-lang/nimble/blob/master/changelog.markdown (x_refsource_MISC)
github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8 (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2021-21373?: CVE-2021-21373 is a high-severity vulnerability in Nim-lang Security, classified under CWE-348. CVSS score: 7.5/10. Published 2021-03-26.
How severe is CVE-2021-21373?: High severity. CVSS v3 base score is 7.5 out of 10.