CVE-2023-35845 — MEDIUM (4.7)

Vulnerability Description

Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.

CVSS Score

4.7

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Anaconda	Anaconda3	2023.03-1
Linux	Linux Kernel	-

Related Weaknesses (CWE)

CWE-295

References

FAQ

What is CVE-2023-35845?

CVE-2023-35845 is a vulnerability with a CVSS score of 4.7 (MEDIUM). Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as ...

How severe is CVE-2023-35845?

CVE-2023-35845 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-35845?

Check the references section above for vendor advisories and patch information. Affected products include: Anaconda Anaconda3, Linux Linux Kernel.