CVE-2021-42969: Command Injection
Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42969?
CVE-2021-42969 is a vulnerability that affects certain versions of Anaconda3 2021.05. It allows an attacker to execute arbitrary OS commands by manipulating the usercustomize.py file.
How does CVE-2021-42969 work?
CVE-2021-42969 works by exploiting an OS command injection vulnerability in Anaconda. When the user installs Anaconda, an attacker can create a new file and write malicious commands in the usercustomize.py file. When the user opens the terminal or activates Anaconda, the commands will be executed.
What is the severity of CVE-2021-42969?
CVE-2021-42969 has a severity rating of 8.8 (Critical).
How can I fix CVE-2021-42969?
To fix CVE-2021-42969, it is recommended to update to a patched version of Anaconda as soon as it becomes available. In the meantime, users should exercise caution and avoid opening terminals or activating Anaconda in untrusted environments.
What are the Common Weakness Enumeration (CWE) identifiers associated with CVE-2021-42969?
CVE-2021-42969 is associated with CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') and CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').