CVE-2025-49842: conda-forge-webservices Privilege Escalation Risk via Default Docker Root User
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the condaforgewebservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49842?
CVE-2025-49842 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-49842?
To mitigate CVE-2025-49842, you should upgrade the conda-forge-webservices package to version 2025.3.24 or later.
What are the risks of CVE-2025-49842?
The risks associated with CVE-2025-49842 include unauthorized access and the ability for attackers to execute commands as the root user within the Docker container.
Which versions of conda-forge-webservices are affected by CVE-2025-49842?
All versions of conda-forge-webservices prior to 2025.3.24 are affected by CVE-2025-49842.
Is CVE-2025-49842 related to Docker security?
Yes, CVE-2025-49842 highlights a Docker security issue by allowing the container to run commands without a specified user, defaulting to root.