1126 matches found
conda-forge-webservices 安全漏洞
conda-forge-webservices is a conda-forge open source web application deployed to run condaforge management commands and linting. A security vulnerability exists in versions of conda-forge-webservices prior to 2025.4.10 that stems from a competitive condition and could lead to the release of a...
PT-2025-16541 · Conda Forge · Conda-Forge-Webservices
Name of the Vulnerable Software and Affected Versions: conda-forge-webservices versions prior to 2025.4.10 Description: A Time-of-Check to Time-of-Use TOCTOU issue has been identified in the conda-forge-webservices component, which can be exploited to introduce unauthorized modifications to build...
CVE-2025-31484
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...
CVE-2025-31484
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...
CVE-2025-31484 conda-forge infrastructure uses a bad token for Azure's cf-staging access
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...
CVE-2025-31484 conda-forge infrastructure uses a bad token for Azure's cf-staging access
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...
CVE-2025-31484
CVE-2025-31484 affects the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, the infrastructure used the wrong Azure cf-staging access token, allowing any feedstock maintainer to upload a package to the conda-forge channel and bypass the standard feedstock-token + upload process. The...
PT-2025-14560 · Unknown · Conda-Forge
Name of the Vulnerable Software and Affected Versions: conda-forge infrastructure affected versions not specified Description: A bug in the conda-forge infrastructure allowed any feedstock maintainer to upload a package to the conda-forge channel, bypassing the feedstock-token + upload process,...
infrastructure 访问控制错误漏洞
infrastructure is an open source library from conda-forge. An access control error vulnerability exists in infrastructure versions 2025-02-10 through 2025-04-01, which stems from the use of an incorrect Azure cf-staging access token, which could lead to bypassing the upload process...
CVE-2025-27510
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in...
Linux Distros Unpatched Vulnerability : CVE-2022-24772
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification...
Linux Distros Unpatched Vulnerability : CVE-2022-24771
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification...
Linux Distros Unpatched Vulnerability : CVE-2022-24773
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification...
CVE-2025-27510
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in...
CVE-2025-27510 RCE in the package conda-forge-metadata
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in...
CVE-2025-27510 RCE in the package conda-forge-metadata
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in...
CVE-2025-27510
CVE-2025-27510 concerns conda-forge-metadata which relies on an optional dependency, conda-oci-mirror, that was neither present on PyPI nor registered by any entity. If an attacker gains control of that dependency, it could enable remote code execution via the affected package’s metadata access. ...
CVE-2025-27510 RCE in the package conda-forge-metadata
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in...
conda-forge-metadata 安全漏洞
conda-forge-metadata is a programmatic access to conda-forge metadata in conda-forge open source. A security vulnerability exists in conda-forge-metadata version 0.4.1 and earlier, which stems from dependency hijacking and could lead to remote code execution...