Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set verifyMode = CVerifyPeer as documented.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nim | Nim-lang | * | 1.4.2 (excluding) |
| Nim | Ubuntu | bionic | * |
| Nim | Ubuntu | esm-apps/bionic | * |
| Nim | Ubuntu | esm-apps/focal | * |
| Nim | Ubuntu | focal | * |
| Nim | Ubuntu | groovy | * |
| Nim | Ubuntu | lunar | * |
| Nim | Ubuntu | trusty | * |
| Nim | Ubuntu | upstream | * |
| Nim | Ubuntu | xenial | * |