Bug 1175332 - (CVE-2020-15694) VUL-0: CVE-2020-15694: nim: httpClient.get().contentLength() fails to properly validate the server response
(CVE-2020-15694)
VUL-0: CVE-2020-15694: nim: httpClient.get().contentLength() fails to properl...
Status: IN_PROGRESS
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Basesystem
Leap 15.3
Other Other
: P3 - Medium : Minor (vote)
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/265343/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-08-17 07:07 UTC by Alexander Bergmann
Modified: 2022-09-12 14:36 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2020-08-17 07:07:35 UTC
CVE-2020-15694

In Nim 1.2.4, the standard library httpClient fails to properly validate the
server response. For example, httpClient.get().contentLength() does not raise
any error if a malicious server provides a negative Content-Length.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15694
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15694
https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241
https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
Comment 1 David Anes 2022-08-10 11:14:26 UTC
Codestream                  Vers.           Request
----------------------------------------------------------------------
Leap:15.1:Update            0.19.6 EOL [4]
Leap:15.2:Update            1.2.12 EOL [4]
Backports:SLE-15:Update     0.19.6 EOL [4]
Backports:SLE-15-SP1:Update 0.19.6 EOL [4]
Backports:SLE-15-SP2:Update 1.2.12 EOL [4]
Backports:SLE-15-SP3:Update 0.19.6 -> 1.6.6 [1]
Backports:SLE-15-SP4:Update 1.2.12 -> 1.6.6 [1]
Factory                     1.6.6 [3] (already there, make the CVE explicitly in changelog)

[1] https://build.opensuse.org/request/show/994306
[2] https://build.opensuse.org/request/show/994305
[3] https://build.opensuse.org/request/show/994303
[4] We are still building up-to-date packages for all Leap and SLE >= 15
in the development project:
* https://build.opensuse.org/package/show/devel:languages:misc/nim
Comment 2 Swamp Workflow Management 2022-08-24 07:16:10 UTC
openSUSE-SU-2022:10095-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1175332,1175333,1175334,1181705,1185083,1185084,1185085,1185948,1192712
CVE References: CVE-2020-15690,CVE-2020-15692,CVE-2020-15693,CVE-2020-15694,CVE-2021-21372,CVE-2021-21373,CVE-2021-21374,CVE-2021-29495,CVE-2021-41259
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP3 (src):    nim-1.6.6-bp153.2.3.1
Comment 3 Swamp Workflow Management 2022-08-27 16:16:00 UTC
openSUSE-SU-2022:10101-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1175332,1175333,1175334,1181705,1185083,1185084,1185085,1185948,1192712
CVE References: CVE-2020-15690,CVE-2020-15692,CVE-2020-15693,CVE-2020-15694,CVE-2021-21372,CVE-2021-21373,CVE-2021-21374,CVE-2021-29495,CVE-2021-41259
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP4 (src):    nim-1.6.6-bp154.2.3.1
Comment 4 David Anes 2022-09-12 14:36:51 UTC
All done. Assigning back to security.