Nim 注入漏洞

漏洞信息详情

Nim是Nim社区的一种静态类型的编程语言。

Nim 1.2.6 之前版本存在注入漏洞，该漏洞源于标准库asyncftpclient没有检查消息是否包含换行符。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/nim-lang/Nim/compare/v1.2.4...v1.2.6

来源:MISC

链接:https://github.com/tintinweb/pub/tree/master/pocs/cve-2020-15690

来源:MISC

链接:https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/asyncftpclient.nim#L145

来源:MLIST

链接:http://www.openwall.com/lists/oss-security/2021/02/04/3

来源:CONFIRM

链接:https://github.com/nim-lang/Nim/compare/v1.2.4...v1.2.6

来源:MISC

链接:https://consensys.net/diligence/vulnerabilities/nim-asyncftpd-crlf-injection/

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-15690

暂无