CVE-2020-15692

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

This update for nim fixes the following issues:

Includes upstream security fixes for:

• (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a CR-LF injection
• (boo#1175334, CVE-2020-15692) mishandle of argument to browsers.openDefaultBrowser
• (boo#1175332, CVE-2020-15694) httpClient.get().contentLength() fails to properly validate the server response
• (boo#1192712, CVE-2021-41259) null byte accepted in getContent function, leading to URI validation bypass
• (boo#1185948, CVE-2021-29495) stdlib httpClient does not validate peer certificates by default
• (boo#1185085, CVE-2021-21374) Improper verification of the SSL/TLS certificate
• (boo#1185084, CVE-2021-21373) 'nimble refresh' falls back to a non-TLS URL in case of error
• (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute arbitrary commands
• (boo#1181705, CVE-2020-15690) Standard library asyncftpclient lacks a check for newline character

Following nim tools now work as expected:

• nim_dbg is now installed.
• nim-gdb can be successfully launched as it finds and loads nim-gdb.py correctly under gdb.
• nimble package manager stores package information per user.
• compiler package can be found and used, as it may be required by other packages.

Update to 1.6.6

• standard library use consistent styles for variable names so it can be used in projects which force a consistent style with --styleCheck:usages option.
• ARC/ORC are now considerably faster at method dispatching, bringing its performance back on the level of the refc memory management.
• Full changelog: https://nim-lang.org/blog/2022/05/05/version-166-released.html

• Previous updates and changelogs:

• 1.6.4: https://nim-lang.org/blog/2022/02/08/version-164-released.html
• 1.6.2: https://nim-lang.org/blog/2021/12/17/version-162-released.html
• 1.6.0: https://nim-lang.org/blog/2021/10/19/version-160-released.html
• 1.4.8: https://nim-lang.org/blog/2021/05/25/version-148-released.html
• 1.4.6: https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html
• 1.4.4: https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html
• 1.4.2: https://nim-lang.org/blog/2020/12/01/version-142-released.html
• 1.4.0: https://nim-lang.org/blog/2020/10/16/version-140-released.html

Update to 1.2.16

• oids: switch from PRNG to random module
• nimc.rst: fix table markup
• nimRawSetjmp: support Windows
• correctly enable chronos
• bigints are not supposed to work on 1.2.x
• disable nimpy
• misc bugfixes
• fixes a 'mixin' statement handling regression [backport:1.2

Update to version 1.2.12

• Fixed GC crash resulting from inlining of the memory allocation procs
• Fixed “incorrect raises effect for $(NimNode)” (#17454)

• from version 1.2.10

• Fixed “JS backend doesn’t handle float->int type conversion “ (#8404)
• Fixed “The “try except” not work when the “OSError: Too many open files” error occurs!” (#15925)
• Fixed “Nim emits #line 0 C preprocessor directives with –debugger:native, with ICE in gcc-10” (#15942)
• Fixed “tfuturevar fails when activated” (#9695)
• Fixed “nre.escapeRe is not gcsafe” (#16103)
• Fixed ““Error: internal error: genRecordFieldAux” - in the “version-1-4” branch” (#16069)
• Fixed “-d:fulldebug switch does not compile with gc:arc” (#16214)
• Fixed “osLastError may randomly raise defect and crash” (#16359)
• Fixed “generic importc proc’s don’t work (breaking lots of vmops procs for js)” (#16428)
• Fixed “Concept: codegen ignores parameter passing” (#16897)
• Fixed “{.push exportc.} interacts with anonymous functions” (#16967)
• Fixed “memory allocation during {.global.} init breaks GC” (#17085)
• Fixed 'Nimble arbitrary code execution for specially crafted package metadata'
  • https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p
  • (boo#1185083, CVE-2021-21372)
• Fixed 'Nimble falls back to…

This update for nim fixes the following issues:

Includes upstream security fixes for:

• (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a CR-LF injection
• (boo#1175334, CVE-2020-15692) mishandle of argument to browsers.openDefaultBrowser
• (boo#1175332, CVE-2020-15694) httpClient.get().contentLength() fails to properly validate the server response
• (boo#1192712, CVE-2021-41259) null byte accepted in getContent function, leading to URI validation bypass
• (boo#1185948, CVE-2021-29495) stdlib httpClient does not validate peer certificates by default
• (boo#1185085, CVE-2021-21374) Improper verification of the SSL/TLS certificate
• (boo#1185084, CVE-2021-21373) 'nimble refresh' falls back to a non-TLS URL in case of error
• (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute arbitrary commands
• (boo#1181705, CVE-2020-15690) Standard library asyncftpclient lacks a check for newline character

Update to 1.6.6

• standard library use consistent styles for variable names so it can be used in projects which force a consistent style with --styleCheck:usages option.
• ARC/ORC are now considerably faster at method dispatching, bringing its performance back on the level of the refc memory management.
• Full changelog: https://nim-lang.org/blog/2022/05/05/version-166-released.html

• Previous updates and changelogs:

• 1.6.4: https://nim-lang.org/blog/2022/02/08/version-164-released.html
• 1.6.2: https://nim-lang.org/blog/2021/12/17/version-162-released.html
• 1.6.0: https://nim-lang.org/blog/2021/10/19/version-160-released.html
• 1.4.8: https://nim-lang.org/blog/2021/05/25/version-148-released.html
• 1.4.6: https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html
• 1.4.4: https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html
• 1.4.2: https://nim-lang.org/blog/2020/12/01/version-142-released.html
• 1.4.0: https://nim-lang.org/blog/2020/10/16/version-140-released.html

update to 1.2.16

• oids: switch from PRNG to random module
• nimc.rst: fix table markup
• nimRawSetjmp: support Windows
• correctly enable chronos
• bigints are not supposed to work on 1.2.x
• disable nimpy
• misc bugfixes
• fixes a 'mixin' statement handling regression [backport:1.2

These are all security issues fixed in the nim-1.6.6-3.1 package on the GA media of openSUSE Tumbleweed.