HTTP Client Response Validation Flaw in Nim 1.2.4

CVE-2020-15694

Summary

In Nim version 1.2.4, the HTTP client within the standard library has a notable flaw in its response validation mechanism. This vulnerability arises because the httpClient does not accurately validate the server's response, allowing malicious actors to exploit this weakness. Specifically, when a server provides a negative Content-Length, the function httpClient.get().contentLength() does not trigger any error, potentially leading to unreliable and unsafe interactions with web services. As a result, applications utilizing this functionality may face security risks, emphasizing the need for developers to address this oversight in their implementations.

References