CVE-2025-35471

Katalog CVE

CVSS 7.8 · High EPSS 0,23%

Kerentanan Uncontrolled Search Path Element pada conda-forge miniforge, conda-forge openssl-feedstock. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.

Rincian

Terbit di NVD

13 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/conda-forge/openssl-feedstock/commit/066e83c5226bafe90a9c0575b077ce30cd5f5921 patch
• https://github.com/conda-forge/openssl-feedstock/issues/201 exploit · issue tracking