CVE-2025-49843

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write access beyond the intended user/owner. This violates the principle of least privilege, which mandates restricting file permissions to the minimum necessary. An attacker could exploit this to access configuration files in shared hosting environments. This issue has been patched in version 3.47.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/conda-forge/conda-smithy/blob/1dc21086a476f6aeb6c1bad8bf58474bf3a8f8f0/conda_smithy/ci_register.py#L109-L111
https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1
https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-h9v8-rrqg-3m95

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) conda-smithy es una herramienta que combina una receta de Conda con configuraciones para compilar usando servicios de CI alojados libremente en un único repositorio. Antes de la versión 3.47.1, la función travis_headers del repositorio conda-smithy creaba archivos con permisos superiores a 0o600, lo que permitía acceso de lectura y escritura a usuarios no autorizados. Esto viola el principio de mínimo privilegio, que obliga a restringir los permisos de archivo al mínimo necesario. Un atacante podría aprovechar esto para acceder a archivos de configuración en entornos de alojamiento compartido. Este problema se ha corregido en la versión 3.47.1.

17 Jun 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-17 21:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-49843

Mitre link : CVE-2025-49843

CVE.ORG link : CVE-2025-49843

JSON object : View

Products Affected

No product.

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2025-49843", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-17T21:15:40.360", "references": [{"url": "https://github.com/conda-forge/conda-smithy/blob/1dc21086a476f6aeb6c1bad8bf58474bf3a8f8f0/conda_smithy/ci_register.py#L109-L111", "source": "security-advisories@github.com"}, {"url": "https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1", "source": "security-advisories@github.com"}, {"url": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-h9v8-rrqg-3m95", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write access beyond the intended user/owner. This violates the principle of least privilege, which mandates restricting file permissions to the minimum necessary. An attacker could exploit this to access configuration files in shared hosting environments. This issue has been patched in version 3.47.1."}, {"lang": "es", "value": "conda-smithy es una herramienta que combina una receta de Conda con configuraciones para compilar usando servicios de CI alojados libremente en un \u00fanico repositorio. Antes de la versi\u00f3n 3.47.1, la funci\u00f3n travis_headers del repositorio conda-smithy creaba archivos con permisos superiores a 0o600, lo que permit\u00eda acceso de lectura y escritura a usuarios no autorizados. Esto viola el principio de m\u00ednimo privilegio, que obliga a restringir los permisos de archivo al m\u00ednimo necesario. Un atacante podr\u00eda aprovechar esto para acceder a archivos de configuraci\u00f3n en entornos de alojamiento compartido. Este problema se ha corregido en la versi\u00f3n 3.47.1."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}