Vulnerability Details CVE-2023-35845
Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 2.9%
CVSS Severity
CVSS v3 Score 4.7
References
Products affected by CVE-2023-35845
-
cpe:2.3:a:anaconda:anaconda3:2023.03-1
-
cpe:2.3:o:linux:linux_kernel:-