CVE-2023-35845

2023-09-1100:00:00

mitre

www.cve.org

anaconda

tls

certificate validation

vulnerability

pip

miniconda

world-writable

linux

cacert.pem

umask

file modification

4.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.