Conda Smithy
Approved changes feed: RSS · Atom
cpe:2.3:a:conda-forge:conda-smithy:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Conda Forge (90e18dab-0b1d-563a-b87e-e1be0566beef) |
|---|---|
| Product | Conda Smithy (7eb669ca-8c50-571e-adb3-e4804d6b82e9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-49843 |
vulnerable | 2026-06-08 07:29:14.996593 |
conda-smithy Has Incorrect Default File Permissions
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write access beyond the intended user/owner. This violates the principle of least privilege, which mandates restricting file permissions to the minimum necessary. An attacker could exploit this to access configuration files in shared hosting environments. This issue has been patched in version 3.47.1.
Published: 2025-06-17T20:39:52.569Z
Updated: 2025-06-18T15:48:45.983Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49824 |
vulnerable | 2026-06-08 07:29:14.966531 |
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified as vulnerable to an Oracle Padding Attack. This vulnerability results from the use of an outdated and insecure padding scheme during RSA encryption. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key. This issue has been patched in version 3.47.1.
Published: 2025-06-17T20:40:02.477Z
Updated: 2025-06-18T15:46:26.019Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.