Conda-build 安全漏洞

Conda-build is a Conda open source command and tool for building conda packages. A security vulnerability exists in Conda-build versions prior to 25.3.0, which stems from the listing of unreleased dependencies in pyproject.toml and could lead to malicious code injection...

CVE-2025-32799: Improper Limitation of a Pathname to a Restricted Directory

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal Tarslip attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal...

Conda-build 路径遍历漏洞

Conda-build is a Conda open source command and tool for building conda packages. A path traversal vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from improper path cleanup of tar entries, which could lead to a path traversal attack...

PT-2025-25588 · Python +1 · Pip +2

Name of the Vulnerable Software and Affected Versions: Conda-build versions prior to 25.3.0 Description: The issue concerns a dependency injection vulnerability. Conda-build lists conda-index as a Python dependency in its pyproject.toml file. Since conda-index is not published in PyPI, an attacke...

PT-2025-25580

Name of the Vulnerable Software and Affected Versions conda-build versions prior to 25.3.1 Description The issue in conda-build allows attackers with filesystem access to exploit a race condition and overwrite a temporary build script, potentially leading to arbitrary code execution under the...

PT-2025-25585 · Unknown · Conda-Build

Name of the Vulnerable Software and Affected Versions: conda-build versions prior to 25.4.0 Description: The conda-build recipe processing logic is vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. This is because conda-build uses the eval function to process...

CVE-2025-32798: Improper Control of Generation of Code

Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build recipe processing logic has been found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process...

Conda-build 代码注入漏洞

Conda-build is a Conda open source command and tool for building conda packages. A code injection vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from an insecure evaluation of recipe selectors and could lead to arbitrary code execution...

TencentOS Server 3: container-tools:rhel8 (TSSA-2025:0203)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0203 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Conda-build 安全漏洞

Conda-build is a Conda open source command and tool for building conda packages. A security vulnerability exists in Conda-build versions prior to 25.3.1, which stems from improperly set permissions in the temporary build script condabuild.sh, which could lead to arbitrary code execution...

CVE-2025-32797: Insecure Inherited Permissions

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the writebuildscripts function in conda-build creates the temporary build script condabuild.sh with overly permissive file permissions 0o766, allowing write access to all users. Attackers with filesystem...

PT-2025-25587 · Unknown · Conda-Build

Name of the Vulnerable Software and Affected Versions: Conda-build versions prior to 25.4.0 Description: The issue is related to path traversal attacks due to improper sanitization of tar entry paths in the conda-build processing logic. This could allow attackers to craft tar archives that write...

TencentOS Server 3: container-tools:4.0 (TSSA-2024:0760)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0760 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: container-tools:rhel8 (TSSA-2024:0761)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0761 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Stack-based Buffer Overflow

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the xmlBuildQName function. An attacker can cause a crash and denial of service by supplying specially crafted XML input that triggers an integer...

SUSE-SU-2025:01466-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2025-30219: Fixed XSS in an error message in Management UI bsc1240071 Other fixes: - Disable parallel make, this causes build failures...

GHSA-RRR2-JCR8-7Q3X @nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852

CVE-2025-36852 describes a critical vulnerability in remote cache extensions used by build systems with bucket-based remote caches (e.g., Amazon S3, Google Cloud Storage). The issue allows contributors with pull request privileges to inject compromised artifacts from untrusted environments into t...

CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...