Filtered by vendor Anaconda Subscriptions
Filtered by product Anaconda3 Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-42969 1 Anaconda 1 Anaconda3 2024-08-04 8.8 High
Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda, an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda, the command will be executed.
CVE-2022-26526 2 Anaconda, Conda 2 Anaconda3, Miniconda3 2024-08-03 7.8 High
Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.
CVE-2023-35845 2 Anaconda, Linux 2 Anaconda3, Linux Kernel 2024-08-02 4.7 Medium
Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.