CVE catalog

CVE-2021-21374

nim: CVE-2021-21374

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.04% · Oct 25, 2026

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to perform MitM can deliver a modified package list containing malicious software packages. If the packages are installed and used the attack escalates to untrusted code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannimsid2.2.12-1fixed
Debiannimforky2.2.12-1fixed
Debiannimbookworm1.6.10-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannimsourcesid1.4.6+really1.4.2-1not yet assignedNot reported[987272]
Debiannimsourceforky1.4.6+really1.4.2-1not yet assignedNot reported[987272]
Debiannimsourcebookworm1.4.6+really1.4.2-1not yet assignedNot reported[987272]

[Debian bug #987272]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [nim]Fixed
    Details (2)

    • 1.6.10-2 · amd64 · bookworm

      Fixed · Fixed: 1.4.6+really1.4.2-1

      dsa · nim · debian · bookworm; dsa · nim · debian · 12

    • 1.6.10-2 · arm64 · bookworm

      Fixed · Fixed: 1.4.6+really1.4.2-1

      dsa · nim · debian · bookworm; dsa · nim · debian · 12

  • [nim-doc]Fixed

    Source package: [nim]

    Details (2)

    • 1.6.10-2 · all · bookworm

      Fixed · Fixed: 1.4.6+really1.4.2-1

      dsa · nim · debian · bookworm; dsa · nim · debian · 12

    • 1.6.10-2 · all · bookworm

      Fixed · Fixed: 1.4.6+really1.4.2-1

      dsa · nim · debian · bookworm; dsa · nim · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]