Read the docs
TI-2025-31739 Aliases CVE-2025-49824

conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack

Priority LOW 9CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified as vulnerable to an Oracle Padding Attack. This vulnerability results from the use of an outdated and insecure padding scheme during RSA encryption. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key. This issue has been patched in version 3.47.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Fixed conda-smithy (conda-forge): 3.47.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
conda-forgeconda-smithybefore 3.47.13.47.1Patch availableCNA
  • conda-smithy Vendorconda-forge Affected before 3.47.1 Fixed in 3.47.1 Patch available CNA

Remediation

  • Fix · CNA conda-smithy (conda-forge) Fixed in 3.47.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49824

References

Other 3

  • TI-2025-20342 RCE in the package conda-forge-metadata CVSS 4.0CRITICAL 9.3
  • TI-2025-24594 conda-forge openssl-feedstock writable OPENSSLDIR CVSS 4.0HIGH 7.0
  • TI-2025-31611 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing CVSS 4.0MEDIUM 4.4
  • TI-2025-22665 conda-forge infrastructure uses a bad token for Azure's cf-staging access CVSS 4.0CRITICAL 9.3
  • TI-2025-23821 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition CVSS 4.0HIGH 7.5
  • TI-2026-34328 Improper access control in conda-forge conda-smithy CVSS 3.1HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences