Vulnerability · Published Jun 17, 2025 · Assigned by GitHub_M

CVE-2025-49824conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack

Low 1.7

In plain English

A low-severity information exposure in conda-smithy from conda-forge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)1.7Low

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified as vulnerable to an Oracle Padding Attack. This vulnerability results from the use of an outdated and insecure padding scheme during RSA encryption. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key. This issue has been patched in version 3.47.1.

Affected products (as reported)

Vendor	Product	Versions
conda-forge	conda-smithy	< 3.47.1

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U

References

https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-2xf4-hg9q-m58q x_refsource_CONFIRM
https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1 x_refsource_MISC
https://github.com/conda-forge/conda-smithy/blob/46a06524eeeb7f59e0969c3967ce5f700643d322/conda_smithy/ci_register.py#L447 x_refsource_MISC