{"id":"CVE-2021-21372","aliases":["DEBIAN-CVE-2021-21372","EUVD-2021-8682","GHSA-rg9f-w24h-962p","UBUNTU-CVE-2021-21372","openSUSE-SU-2021:0618-1","openSUSE-SU-2021:0628-1","openSUSE-SU-2022:10095-1","openSUSE-SU-2022:10101-1","openSUSE-SU-2024:11093-1"],"status":"published","title":"Nimble arbitrary code execution for specially crafted package metadata","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03618,"percentile":0.89657,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-74","CWE-78"],"published":"2021-03-26T21:20:15Z","modified":"2026-10-24T10:50:23Z","fixes":[{"ecosystem":"Debian:12","package":"nim","fixed_in":["1.4.6+really1.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nim","fixed_in":["1.4.6+really1.4.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6+really1.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6+really1.4.2-1"}]}],"versions":["0.11.2+dfsg1-1","0.11.2+dfsg1-2","0.11.2+dfsg1-3","0.11.2+dfsg1-4","0.12.0-1","0.12.0-2","0.13.0-1","0.14.2-1","0.15.0-1","0.15.0-2","0.15.0-3","0.15.2-1","0.15.2-2","0.16.0-1","0.17.0-1","0.17.0-2","0.17.0-2~bpo9+1","0.17.2-1","0.18.0-1","0.18.0-2","0.19.0-1","0.19.2-1","0.19.2-2","0.19.4-1","0.19.6-1","0.19.6-2","0.20.0-1","0.20.0-2","0.20.2-1","1.0.0-1","1.0.0-1~bpo10+1","1.0.2-1","1.0.2-1~bpo10+1","1.0.2~a-1","1.0.2~b-1","1.0.2~rc-1","1.0.3~rc-1","1.0.4-1","1.0.4-1~bpo10+1","1.0.5~rc-1","1.0.6-1","1.2.0-1","1.2.0~rc-1","1.2.0~rc2-1","1.2.0~rc3-1","1.2.1~rc1-1","1.2.1~rc2-1","1.2.2-1","1.2.4-1","1.2.6-1","1.2.6~rc1-1","1.4.0-1","1.4.2-1","1.4.6-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2+dfsg1-4","0.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.2-1ubuntu1","0.17.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.2-1","1.0.2-1","1.0.3~rc-1","1.0.4-1","1.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1","1.6.14-1ubuntu1","1.6.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.14-1ubuntu2","2.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-2","2.2.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1","2.2.4-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-bp152.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-bp153.2.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-bp153.2.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-bp154.2.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-bp154.2.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-1.7"}]}],"bundled":3}],"products":[{"vendor":"embysupport","product":"security"},{"vendor":"nim-lang","product":"nim"},{"vendor":"nim-lang","product":"security"}],"references":[{"url":"https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21372","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21372","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21372","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NV5NCUH7W5BZXNXEYHHUQGISDZUK64IU/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185083","tags":["report"]},{"url":"https://bugzilla.suse.com/1185084","tags":["report"]},{"url":"https://bugzilla.suse.com/1185085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21374","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3KP4YJ5PY3MI63TQDVZA6BQHCQPAXBGB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HM5F2H5AWO4WRQSTOWMODGKMXAHHBVRH/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175332","tags":["report"]},{"url":"https://bugzilla.suse.com/1175333","tags":["report"]},{"url":"https://bugzilla.suse.com/1175334","tags":["report"]},{"url":"https://bugzilla.suse.com/1181705","tags":["report"]},{"url":"https://bugzilla.suse.com/1185948","tags":["report"]},{"url":"https://bugzilla.suse.com/1192712","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41259","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SNDISR45BBTIWW5MDTIQOSRHOEV3XUKF/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-21372","title":"Nimble arbitrary code execution for specially crafted package metadata","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T21:20:15Z","modified":"2024-08-03T18:09:15.92Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-74"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-8682","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T21:20:15Z","modified":"2024-08-03T18:09:15Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:06.347262Z"}],"nvd":[{"id":"CVE-2021-21372","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T22:15:12.697Z","modified":"2026-06-17T03:35:24.803Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-74","CWE-78"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"CVE-2021-21372","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T22:15:12.697Z","modified":"2026-10-24T10:50:23.869816102Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21372","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T22:15:12.697Z","modified":"2026-10-23T18:03:48.890528211Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-21372","description":"Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.","status":"published","published":"2021-03-26T22:15:00Z","modified":"2026-10-17T12:56:19.327149158Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"openSUSE-SU-2021:0618-1","title":"Security update for nim","description":"This update for nim fixes the following issues:\n\nnum was updated to version 1.2.12:\n\n* Fixed GC crash resulting from inlining of the memory allocation procs\n* Fixed “incorrect raises effect for $(NimNode)” (#17454)\n\nFrom version 1.2.10:\n\n* Fixed “JS backend doesn’t handle float-\u003eint type conversion “ (#8404)\n* Fixed “The “try except” not work when the “OSError:\n  Too many open files” error occurs!” (#15925)\n* Fixed “Nim emits #line 0 C preprocessor directives with\n  –debugger:native, with ICE in gcc-10” (#15942)\n* Fixed “tfuturevar fails when activated” (#9695)\n* Fixed “nre.escapeRe is not gcsafe” (#16103)\n* Fixed ““Error: internal error: genRecordFieldAux” - in\n  the “version-1-4” branch” (#16069)\n* Fixed “-d:fulldebug switch does not compile with gc:arc” (#16214)\n* Fixed “osLastError may randomly raise defect and crash” (#16359)\n* Fixed “generic importc proc’s don’t work (breaking lots\n  of vmops procs for js)” (#16428)\n* Fixed “Concept: codegen ignores parameter passing” (#16897)\n* Fixed “{.push exportc.} interacts with anonymous functions” (#16967)\n* Fixed “memory allocation during {.global.} init breaks GC” (#17085)\n* Fixed 'Nimble arbitrary code execution for specially crafted package metadata'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p\n  + (boo#1185083, CVE-2021-21372)\n* Fixed 'Nimble falls back to insecure http url when fetching packages'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8\n  + (boo#1185084, CVE-2021-21373)\n* Fixed 'Nimble fails to validate certificates due to insecure httpClient defaults'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx\n  + (boo#1185085, CVE-2021-21374)\n\nfrom version 1.2.8\n\n* Fixed “Defer and –gc:arc” (#15071)\n* Fixed “Issue with –gc:arc at compile time” (#15129)\n* Fixed “Nil check on each field fails in generic function” (#15101)\n* Fixed “[strscans] scanf doesn’t match a single character with\n  $+ if it’s the end of the string” (#15064)\n* Fixed “Crash and incorrect return values when using\n  readPasswordFromStdin on Windows.” (#15207)\n* Fixed “Inconsistent unsigned -\u003e signed RangeDefect usage\n  across integer sizes” (#15210)\n* Fixed “toHex results in RangeDefect exception when\n  used with large uint64” (#15257)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “proc execCmdEx doesn’t work with -d:useWinAnsi” (#14203)\n* Fixed “memory corruption in tmarshall.nim” (#9754)\n* Fixed “Wrong number of variables” (#15360)\n* Fixed “defer doesnt work with block, break and await” (#15243)\n* Fixed “Sizeof of case object is incorrect. Showstopper” (#15516)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “regression(1.0.2 =\u003e 1.0.4) VM register messed up\n  depending on unrelated context” (#15704)\n\nfrom version 1.2.6\n\n* Fixed “The pegs module doesn’t work with generics!” (#14718)\n* Fixed “[goto exceptions] {.noReturn.} pragma is not detected\n  in a case expression” (#14458)\n* Fixed “[exceptions:goto] C compiler error with dynlib pragma\n  calling a proc” (#14240)\n* Fixed “Nim source archive install: ‘install.sh’ fails with error:\n  cp: cannot stat ‘bin/nim-gdb’: No such file or directory” (#14748)\n* Fixed “Stropped identifiers don’t work as field names in\n  tuple literals” (#14911)\n* Fixed “uri.decodeUrl crashes on incorrectly formatted input” (#14082)\n* Fixed “odbcsql module has some wrong integer types” (#9771)\n* Fixed “[ARC] Compiler crash declaring a finalizer proc\n  directly in ‘new’” (#15044)\n* Fixed “code with named arguments in proc of winim/com can\n  not been compiled” (#15056)\n* Fixed “javascript backend produces javascript code with syntax\n  error in object syntax” (#14534)\n* Fixed “[ARC] SIGSEGV when calling a closure as a tuple\n  field in a seq” (#15038)\n* Fixed “Compiler crashes when using string as object variant\n  selector with else branch” (#14189)\n* Fixed “Constructing a uint64 range on a 32-bit machine leads\n  to incorrect codegen” (#14616)\n\nUpdate to version 1.2.2:\n\n* See https://nim-lang.org/blog.html for details\n\nUpdate to version 1.0.2:\n\n* See https://nim-lang.org/blog.html for details\n","status":"published","published":"2021-04-25T18:05:14Z","modified":"2026-02-04T04:16:07.767822Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0628-1","title":"Security update for nim","description":"This update for nim fixes the following issues:\n\nnum was updated to version 1.2.12:\n\n* Fixed GC crash resulting from inlining of the memory allocation procs\n* Fixed “incorrect raises effect for $(NimNode)” (#17454)\n\nFrom version 1.2.10:\n\n* Fixed “JS backend doesn’t handle float-\u003eint type conversion “ (#8404)\n* Fixed “The “try except” not work when the “OSError:\n  Too many open files” error occurs!” (#15925)\n* Fixed “Nim emits #line 0 C preprocessor directives with\n  –debugger:native, with ICE in gcc-10” (#15942)\n* Fixed “tfuturevar fails when activated” (#9695)\n* Fixed “nre.escapeRe is not gcsafe” (#16103)\n* Fixed ““Error: internal error: genRecordFieldAux” - in\n  the “version-1-4” branch” (#16069)\n* Fixed “-d:fulldebug switch does not compile with gc:arc” (#16214)\n* Fixed “osLastError may randomly raise defect and crash” (#16359)\n* Fixed “generic importc proc’s don’t work (breaking lots\n  of vmops procs for js)” (#16428)\n* Fixed “Concept: codegen ignores parameter passing” (#16897)\n* Fixed “{.push exportc.} interacts with anonymous functions” (#16967)\n* Fixed “memory allocation during {.global.} init breaks GC” (#17085)\n* Fixed 'Nimble arbitrary code execution for specially crafted package metadata'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p\n  + (boo#1185083, CVE-2021-21372)\n* Fixed 'Nimble falls back to insecure http url when fetching packages'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8\n  + (boo#1185084, CVE-2021-21373)\n* Fixed 'Nimble fails to validate certificates due to insecure httpClient defaults'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx\n  + (boo#1185085, CVE-2021-21374)\n\nfrom version 1.2.8\n\n* Fixed “Defer and –gc:arc” (#15071)\n* Fixed “Issue with –gc:arc at compile time” (#15129)\n* Fixed “Nil check on each field fails in generic function” (#15101)\n* Fixed “[strscans] scanf doesn’t match a single character with\n  $+ if it’s the end of the string” (#15064)\n* Fixed “Crash and incorrect return values when using\n  readPasswordFromStdin on Windows.” (#15207)\n* Fixed “Inconsistent unsigned -\u003e signed RangeDefect usage\n  across integer sizes” (#15210)\n* Fixed “toHex results in RangeDefect exception when\n  used with large uint64” (#15257)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “proc execCmdEx doesn’t work with -d:useWinAnsi” (#14203)\n* Fixed “memory corruption in tmarshall.nim” (#9754)\n* Fixed “Wrong number of variables” (#15360)\n* Fixed “defer doesnt work with block, break and await” (#15243)\n* Fixed “Sizeof of case object is incorrect. Showstopper” (#15516)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “regression(1.0.2 =\u003e 1.0.4) VM register messed up\n  depending on unrelated context” (#15704)\n\nfrom version 1.2.6\n\n* Fixed “The pegs module doesn’t work with generics!” (#14718)\n* Fixed “[goto exceptions] {.noReturn.} pragma is not detected\n  in a case expression” (#14458)\n* Fixed “[exceptions:goto] C compiler error with dynlib pragma\n  calling a proc” (#14240)\n* Fixed “Nim source archive install: ‘install.sh’ fails with error:\n  cp: cannot stat ‘bin/nim-gdb’: No such file or directory” (#14748)\n* Fixed “Stropped identifiers don’t work as field names in\n  tuple literals” (#14911)\n* Fixed “uri.decodeUrl crashes on incorrectly formatted input” (#14082)\n* Fixed “odbcsql module has some wrong integer types” (#9771)\n* Fixed “[ARC] Compiler crash declaring a finalizer proc\n  directly in ‘new’” (#15044)\n* Fixed “code with named arguments in proc of winim/com can\n  not been compiled” (#15056)\n* Fixed “javascript backend produces javascript code with syntax\n  error in object syntax” (#14534)\n* Fixed “[ARC] SIGSEGV when calling a closure as a tuple\n  field in a seq” (#15038)\n* Fixed “Compiler crashes when using string as object variant\n  selector with else branch” (#14189)\n* Fixed “Constructing a uint64 range on a 32-bit machine leads\n  to incorrect codegen” (#14616)\n\nUpdate to version 1.2.2:\n\n* See https://nim-lang.org/blog.html for details\n\nUpdate to version 1.0.2:\n\n* See https://nim-lang.org/blog.html for details\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-04-29T14:05:41Z","modified":"2026-02-04T03:34:35.521317Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2022:10095-1","title":"Security update for nim","description":"This update for nim fixes the following issues:\n\nIncludes upstream security fixes for:\n\n* (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a \n  CR-LF injection\n* (boo#1175334, CVE-2020-15692) mishandle of argument to \n  browsers.openDefaultBrowser\n* (boo#1175332, CVE-2020-15694) httpClient.get().contentLength()\n  fails to properly validate the server response\n* (boo#1192712, CVE-2021-41259) null byte accepted in getContent\n  function, leading to URI validation bypass\n* (boo#1185948, CVE-2021-29495) stdlib httpClient does not\n  validate peer certificates by default\n* (boo#1185085, CVE-2021-21374) Improper verification of the \n  SSL/TLS certificate\n* (boo#1185084, CVE-2021-21373) 'nimble refresh' falls back to a \n  non-TLS URL in case of error\n* (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute\n  arbitrary commands\n* (boo#1181705, CVE-2020-15690) Standard library asyncftpclient \n  lacks a check for newline character\n\nFollowing nim tools now work as expected:\n\n* nim_dbg is now installed.\n* nim-gdb can be successfully launched as it finds and loads\n  nim-gdb.py correctly under gdb.\n* nimble package manager stores package information per user.\n* compiler package can be found and used, as it may be required\n  by other packages.\n  \nUpdate to 1.6.6\n\n* standard library use consistent styles for variable names so it\n  can be used in projects which force a consistent style with \n  --styleCheck:usages option. \n* ARC/ORC are now considerably faster at method dispatching, \n  bringing its performance back on the level of the refc memory \n  management.\n* Full changelog:\n  https://nim-lang.org/blog/2022/05/05/version-166-released.html\n- Previous updates and changelogs:\n* 1.6.4: \n  https://nim-lang.org/blog/2022/02/08/version-164-released.html\n* 1.6.2: \n  https://nim-lang.org/blog/2021/12/17/version-162-released.html\n* 1.6.0: \n  https://nim-lang.org/blog/2021/10/19/version-160-released.html\n* 1.4.8: \n  https://nim-lang.org/blog/2021/05/25/version-148-released.html\n* 1.4.6: \n  https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html\n* 1.4.4: \n  https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html\n* 1.4.2: \n  https://nim-lang.org/blog/2020/12/01/version-142-released.html\n* 1.4.0: \n  https://nim-lang.org/blog/2020/10/16/version-140-released.html\n\nUpdate to 1.2.16\n\n* oids: switch from PRNG to random module\n* nimc.rst: fix table markup\n* nimRawSetjmp: support Windows\n* correctly enable chronos\n* bigints are not supposed to work on 1.2.x\n* disable nimpy\n* misc bugfixes\n* fixes a 'mixin' statement handling regression [backport:1.2 \n\nUpdate to version 1.2.12  \n\n* Fixed GC crash resulting from inlining of the memory\n  allocation procs\n* Fixed “incorrect raises effect for $(NimNode)” (#17454)\n- from version 1.2.10\n* Fixed “JS backend doesn’t handle float-\u003eint type conversion “ (#8404)\n* Fixed “The “try except” not work when the “OSError:\n  Too many open files” error occurs!” (#15925)\n* Fixed “Nim emits #line 0 C preprocessor directives with\n  –debugger:native, with ICE in gcc-10” (#15942)\n* Fixed “tfuturevar fails when activated” (#9695)\n* Fixed “nre.escapeRe is not gcsafe” (#16103)\n* Fixed ““Error: internal error: genRecordFieldAux” - in\n  the “version-1-4” branch” (#16069)\n* Fixed “-d:fulldebug switch does not compile with gc:arc” (#16214)\n* Fixed “osLastError may randomly raise defect and crash” (#16359)\n* Fixed “generic importc proc’s don’t work (breaking lots\n  of vmops procs for js)” (#16428)\n* Fixed “Concept: codegen ignores parameter passing” (#16897)\n* Fixed “{.push exportc.} interacts with anonymous functions” (#16967)\n* Fixed “memory allocation during {.global.} init breaks GC” (#17085)\n* Fixed 'Nimble arbitrary code execution for specially crafted package metadata'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p\n  + (boo#1185083, CVE-2021-21372)\n* Fixed 'Nimble falls back to insecure http url when fetching packages'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8\n  + (boo#1185084, CVE-2021-21373)\n* Fixed 'Nimble fails to validate certificates due to insecure httpClient defaults'\n  + https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx\n  + (boo#1185085, CVE-2021-21374)\n- from version 1.2.8\n* Fixed “Defer and –gc:arc” (#15071)\n* Fixed “Issue with –gc:arc at compile time” (#15129)\n* Fixed “Nil check on each field fails in generic function” (#15101)\n* Fixed “[strscans] scanf doesn’t match a single character with\n  $+ if it’s the end of the string” (#15064)\n* Fixed “Crash and incorrect return values when using\n  readPasswordFromStdin on Windows.” (#15207)\n* Fixed “Inconsistent unsigned -\u003e signed RangeDefect usage\n  across integer sizes” (#15210)\n* Fixed “toHex results in RangeDefect exception when\n  used with large uint64” (#15257)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “proc execCmdEx doesn’t work with -d:useWinAnsi” (#14203)\n* Fixed “memory corruption in tmarshall.nim” (#9754)\n* Fixed “Wrong number of variables” (#15360)\n* Fixed “defer doesnt work with block, break and await” (#15243)\n* Fixed “Sizeof of case object is incorrect. Showstopper” (#15516)\n* Fixed “Mixing ‘return’ with expressions is allowed in 1.2” (#15280)\n* Fixed “regression(1.0.2 =\u003e 1.0.4) VM register messed up\n  depending on unrelated context” (#15704)\n- from version 1.2.6\n* Fixed “The pegs module doesn’t work with generics!” (#14718)\n* Fixed “[goto exceptions] {.noReturn.} pragma is not detected\n  in a case expression” (#14458)\n* Fixed “[exceptions:goto] C compiler error with dynlib pragma\n  calling a proc” (#14240)\n* Fixed “Nim source archive install: ‘install.sh’ fails with error:\n  cp: cannot stat ‘bin/nim-gdb’: No such file or directory” (#14748)\n* Fixed “Stropped identifiers don’t work as field names in\n  tuple literals” (#14911)\n* Fixed “uri.decodeUrl crashes on incorrectly formatted input” (#14082)\n* Fixed “odbcsql module has some wrong integer types” (#9771)\n* Fixed “[ARC] Compiler crash declaring a finalizer proc\n  directly in ‘new’” (#15044)\n* Fixed “code with named arguments in proc of winim/com can\n  not been compiled” (#15056)\n* Fixed “javascript backend produces javascript code with syntax\n  error in object syntax” (#14534)\n* Fixed “[ARC] SIGSEGV when calling a closure as a tuple\n  field in a seq” (#15038)\n* Fixed “Compiler crashes when using string as object variant\n  selector with else branch” (#14189)\n* Fixed “Constructing a uint64 range on a 32-bit machine leads\n  to incorrect codegen” (#14616)\n\nUpdate to version 1.2.2:\n\n* See https://nim-lang.org/blog.html for details\n- Enable the full testsuite in the %check section\n* Add build dependencies to run the testsuite\n* Whitelists a few tests that are not passing yet\n\nUpdate to version 1.0.2:\n\n* See https://nim-lang.org/blog.html for details\n- Update dependencies (based on changes by Federico Ceratto\n\n","status":"published","published":"2022-08-24T02:33:29Z","modified":"2026-02-04T03:30:30.340996Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10101-1","title":"Security update for nim","description":"This update for nim fixes the following issues:\n\nIncludes upstream security fixes for:\n\n* (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a \n  CR-LF injection\n* (boo#1175334, CVE-2020-15692) mishandle of argument to \n  browsers.openDefaultBrowser\n* (boo#1175332, CVE-2020-15694) httpClient.get().contentLength()\n  fails to properly validate the server response\n* (boo#1192712, CVE-2021-41259) null byte accepted in getContent\n  function, leading to URI validation bypass\n* (boo#1185948, CVE-2021-29495) stdlib httpClient does not\n  validate peer certificates by default\n* (boo#1185085, CVE-2021-21374) Improper verification of the \n  SSL/TLS certificate\n* (boo#1185084, CVE-2021-21373) 'nimble refresh' falls back to a \n  non-TLS URL in case of error\n* (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute\n  arbitrary commands\n* (boo#1181705, CVE-2020-15690) Standard library asyncftpclient \n  lacks a check for newline character\n\nUpdate to 1.6.6\n\n* standard library use consistent styles for variable names so it\n  can be used in projects which force a consistent style with \n  --styleCheck:usages option. \n* ARC/ORC are now considerably faster at method dispatching, \n  bringing its performance back on the level of the refc memory \n  management.\n* Full changelog:\n  https://nim-lang.org/blog/2022/05/05/version-166-released.html\n- Previous updates and changelogs:\n* 1.6.4: \n  https://nim-lang.org/blog/2022/02/08/version-164-released.html\n* 1.6.2: \n  https://nim-lang.org/blog/2021/12/17/version-162-released.html\n* 1.6.0: \n  https://nim-lang.org/blog/2021/10/19/version-160-released.html\n* 1.4.8: \n  https://nim-lang.org/blog/2021/05/25/version-148-released.html\n* 1.4.6: \n  https://nim-lang.org/blog/2021/04/15/versions-146-and-1212-released.html\n* 1.4.4: \n  https://nim-lang.org/blog/2021/02/23/versions-144-and-1210-released.html\n* 1.4.2: \n  https://nim-lang.org/blog/2020/12/01/version-142-released.html\n* 1.4.0: \n  https://nim-lang.org/blog/2020/10/16/version-140-released.html\n\nupdate to 1.2.16\n\n* oids: switch from PRNG to random module\n* nimc.rst: fix table markup\n* nimRawSetjmp: support Windows\n* correctly enable chronos\n* bigints are not supposed to work on 1.2.x\n* disable nimpy\n* misc bugfixes\n* fixes a 'mixin' statement handling regression [backport:1.2 \n","status":"published","published":"2022-08-27T12:33:24Z","modified":"2026-02-04T04:03:16.711295Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11093-1","title":"nim-1.2.12-1.7 on GA media","description":"These are all security issues fixed in the nim-1.2.12-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:38.601523Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}