CVE-2023-35845: Medium severity anaconda3 vulnerability

Published Sep 11, 2023

Updated

Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.

Affected Software

2 affected components

Anaconda Anaconda3=2023.03-1

Linux Linux kernel

Event History

Sep 11, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is CVE-2023-35845?

CVE-2023-35845 is a vulnerability in Anaconda 3 2023.03-1-Linux that allows local users to disrupt TLS certificate validation.

How does CVE-2023-35845 work?

CVE-2023-35845 works by allowing local users to modify the cacert.pem file used by the installed pip program.

What is the severity of CVE-2023-35845?

The severity of CVE-2023-35845 is medium, with a CVSS score of 4.7.

How can I fix CVE-2023-35845?

To fix CVE-2023-35845, you should ensure that the files installed by Anaconda 3, such as cacert.pem, are not world-writable.

Where can I find more information about CVE-2023-35845?

More information about CVE-2023-35845 can be found at https://uponfurtherinvestigation.blogspot.com/2023/06/cve-2023-35845-anaconda3-creates.html.