CVE-2021-29495 Information

Description

Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2 httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or as a workaround set erifyMode = CVerifyPeer\ as documented.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Reference

https://github.com/nim-lang/security/security/advisories/GHSA-9vqv-2jj9-7mqr

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.5