We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-32784

conda-forge-webservices has an Unauthorized Artifact Modification Race Condition



Description

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized as a Time-of-Check to Time-of-Use (TOCTOU) issue, can be exploited to introduce unauthorized modifications to build artifacts stored in the cf-staging Anaconda channel. Exploitation may result in the unauthorized publication of malicious artifacts to the production conda-forge channel. The core vulnerability results from the absence of atomicity between the hash validation and the artifact copy operation. This gap allows an attacker, with access to the cf-staging token, to overwrite the validated artifact with a malicious version immediately after hash verification, but before the copy action is executed. As the cf-staging channel permits artifact overwrites, such an operation can be carried out using the anaconda upload --force command. This vulnerability is fixed in 2025.4.10.

Reserved 2025-04-10 | Published 2025-04-15 | Updated 2025-04-17 | Assigner GitHub_M


HIGH: 7.5CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Product status

< 2025.4.10
affected

References

github.com/...rvices/security/advisories/GHSA-28cx-74fp-g2g2

github.com/...ommit/141ed27617068debd150956341551df3a5a3807d

cve.org (CVE-2025-32784)

nvd.nist.gov (CVE-2025-32784)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-32784

Support options

Helpdesk Chat, Email, Knowledgebase