CVE-2025-32800

Katalog CVE

CVSS 9.8 · Critical EPSS 0,65%

Kerentanan Reliance on Insufficiently Trustworthy Component pada anaconda conda-build. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary (malicious) code to the package, and then exploit pip install commands by injecting the malicious dependency in the solve. This issue has been fixed in version 25.3.0. A workaround involves using --no-deps for pip install-ing the project from the repository.

Rincian

Terbit di NVD

16 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1357: Reliance on Insufficiently Trustworthy Component

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/conda/conda-build/security/advisories/GHSA-83gh-p93g-cwgx advisory vendor
• https://github.com/conda/conda-build/commit/f5a6aeef0d5d6940b8c2a88796910dc7476a62bb patch
• https://drive.google.com/file/d/18qe97zxcpTn2l84187A9meGCi2Wg-n_Y/view exploit · deskripsi teknis