PT-2025-25658 · Conda Forge · Conda-Forge-Webservices

H4Pp1N3Ss · Published 2025-06-17 · Updated 2025-06-17 · CVE-2025-49842

Positive Technologies (AI Summary)

CVSS v4.0

1.0

Low

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions conda-forge-webservices versions prior to 2025.3.24

Description The conda-forge-webservices web app, used to run conda-forge admin commands and linting, has an issue where the conda forge webservice Docker container executes commands without specifying a user, defaulting to the root user. This increases the risk of privilege escalation and host compromise if a vulnerability is exploited.

Recommendations For versions prior to 2025.3.24, update to version 2025.3.24 to resolve the issue. As a temporary workaround, consider configuring the Docker container to run as a non-root user until the patch is applied.

Exploit

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-49842

GHSA-3CJ6-WC22-WVPV

Affected Products

Conda-Forge-Webservices

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49842.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-49842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49842 · Security Note
• https://github.com/conda-forge/conda-forge-webservices/security/advisories/GHSA-3cj6-wc22-wvpv · Note
• https://github.com/conda-forge/conda-forge-webservices/commit/c28b67f833f32299cc47eef8ad226ca991db67ae · Note
• https://twitter.com/VulmonFeeds/status/1934984133962236029 · Twitter Post
• https://twitter.com/CVEnew/status/1934984675325563292 · Twitter Post