This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-15693 →

DEBIAN-CVE-2020-15693

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls...

Original description

The description as published by the source.

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]

Debian:14 nim

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]

References

advisory security-tracker.debian.org