Vulnerability · Published May 13, 2025 · Assigned by cisa-cg
CVE-2025-35471conda-forge openssl-feedstock writable OPENSSLDIR
High 7.3
In plain English
A high-severity uncontrolled search path in miniforge from conda-forge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| conda-forge | openssl-feedstock | 0 – before 066e83c |
| conda-forge | miniforge | 0 – before 24.5.0 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H