CVE-2020-15694
- State
- Published
- Severity
- Not scored
- Published
- Aug 14, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jul 13, 2020
Description
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241
- https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
- [oss-security] 20210204 [CVE-2020-15693, CVE-2020-15694] Nim - stdlib Httpclient - Header Crlf Injection & Server Response Validationmailing-list
- https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.