PT-2022-11758 · Anaconda3 · Anaconda3

Published 2022-05-13 · Updated 2024-02-14 · CVE-2021-42969

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Anaconda3 version 2021.05

Description The issue concerns OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. This allows the execution of commands when the user opens the terminal or activates Anaconda.

Recommendations For Anaconda3 version 2021.05, consider restricting access to the usercustomize.py file to prevent unauthorized modifications until a patch is available. As a temporary workaround, avoid using the usercustomize.py file for customizations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BIT-MINICONDA-2021-42969

CVE-2021-42969

Affected Products

Anaconda3

References · 5

• 🔥 https://yuaneuro.cn/anaconda/anaconda_command_execution.docx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42969 · Security Note
• https://osv.dev/vulnerability/BIT-miniconda-2021-42969 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42969 · Vendor Advisory
• https://t.me/cibsecurity/42632 · Telegram Post