This update for nim fixes the following issues:
Includes upstream security fixes for:
* (boo#1175333, CVE-2020-15693) httpClient is vulnerable to a CR-LF
injection
* (boo#1175334, CVE-2020-15692) mishandle of argument to
browsers.openDefaultBrowser
* (boo#1175332, CVE-2020-15694) httpClient.get().contentLength() fails to
properly validate the server response
* (boo#1192712, CVE-2021-41259) null byte accepted in getContent function,
leading to URI validation bypass
* (boo#1185948, CVE-2021-29495) stdlib httpClient does not validate peer
certificates by default
* (boo#1185085, CVE-2021-21374) Improper verification of the SSL/TLS
certificate
* (boo#1185084, CVE-2021-21373) "nimble refresh" falls back to a non-TLS
URL in case of error
* (boo#1185083, CVE-2021-21372) doCmd can be leveraged to execute
arbitrary commands
* (boo#1181705, CVE-2020-15690) Standard library asyncftpclient lacks a
check for newline...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP4:
zypper in -t patch openSUSE-2022-10101=1
- openSUSE Backports SLE-15-SP4 (aarch64 ppc64le x86_64):
nim-1.6.6-bp154.2.3.1
https://www.suse.com/security/cve/CVE-2020-15690.html
https://www.suse.com/security/cve/CVE-2020-15692.html
https://www.suse.com/security/cve/CVE-2020-15693.html
https://www.suse.com/security/cve/CVE-2020-15694.html
https://www.suse.com/security/cve/CVE-2021-21372.html
https://www.suse.com/security/cve/CVE-2021-21373.html
https://www.suse.com/security/cve/CVE-2021-21374.html
https://www.suse.com/security/cve/CVE-2021-29495.html
https://www.suse.com/security/cve/CVE-2021-41259.html
https://bugzilla.suse.com/1175332
https://bugzilla.suse.com/1175333
https://bugzilla.suse.com/1175334
https://bugzilla.suse.com/1181705
https://bugzilla.suse.com/1185083
https://bugzilla.suse.com/1185084
https://bugzilla.suse.com/1185085
https://bugzilla.suse.com/1185948
https://bugzilla.suse.com/1192712
Get the latest Linux and open source security news straight to your inbox.