Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2025-35471

conda-forge openssl-feedstock writable OPENSSLDIR

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

conda-forge openssl-feedstock

Default version status: unknown

  • 0 to < 066e83caffected
  • 066e83cunaffected

conda-forge miniforge

Default version status: unknown

  • 0 to < 24.5.0affected
  • 24.5.0unaffected

References