| Revision Date: | 2022-05-22 | Version: | 1 |
| Title: | CVE-2021-41259 |
| Description: |
Nim is a systems programming language with a focus on efficiency, expressiveness, and elegance. In affected versions the uri.parseUri function which may be used to validate URIs accepts null bytes in the input URI. This behavior could be used to bypass URI validation. For example: parseUri("http://localhost\0hello").hostname is set to "localhost\0hello". Additionally, httpclient.getContent accepts null bytes in the input URL and ignores any data after the first null byte. Example: getContent("http://localhost\0hello") makes a request to localhost:80. An attacker can use a null bytes to bypass the check and mount a SSRF attack.
|
| Family: | unix | Class: | vulnerability |
| Status: | | Reference(s): | Mitre CVE-2021-41259
SUSE CVE-2021-41259
openSUSE-SU-2021:1585-1
openSUSE-SU-2021:1592-1
|
| Platform(s): | openSUSE Leap 15.2
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Linux Enterprise Storage 7
SUSE Manager Proxy 4.1
SUSE Manager Server 4.1
SUSE Package Hub for SUSE Linux Enterprise 15 SP2
| Product(s): | |
| Definition Synopsis |
| openSUSE Leap 15.2 is installed AND Package Information
nim-1.2.12-lp152.2.6.1 is installed
AND nim is signed with openSUSE key
|
| Definition Synopsis |
| SUSE Package Hub for SUSE Linux Enterprise 15 SP2 is installed
AND nim-1.2.12-bp152.4.6.1 is installed
|