PT-2025-25762 · Unknown · Conda-Smithy

Jaimergp · Published 2025-06-17 · Updated 2025-06-18 · CVE-2025-49824

Positive Technologies (AI Summary)

CVSS v4.0

1.7

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.47.1

Description The issue results from the use of an outdated and insecure padding scheme during RSA encryption in the travis encrypt binstar token implementation. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key.

Recommendations For versions prior to 3.47.1, update to version 3.47.1 to resolve the issue. As a temporary workaround, consider restricting access to the travis encrypt binstar token implementation until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-49824

GHSA-2XF4-HG9Q-M58Q

Affected Products

Conda-Smithy

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49824.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49824 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49824 · Vendor Advisory
• https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1 · Note
• https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-2xf4-hg9q-m58q · Note
• https://github.com/conda-forge/conda-smithy/blob/46a06524eeeb7f59e0969c3967ce5f700643d322/conda_smithy/ci_register.py#L447 · Note
• https://t.me/cvetracker/26470 · Telegram Post
• https://twitter.com/CVEnew/status/1935078717233217619 · Twitter Post