CVE-2025-49842
BaseFortify
Publication date: 2025-06-17
Last updated on: 2025-06-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the conda-forge-webservices Docker container runs commands as the root user by default, since it does not specify a non-root user. Running as root inside a container increases the risk that if an attacker exploits any other vulnerability, they could escalate privileges and potentially compromise the host system. This issue was fixed by modifying the Docker container to run as a dedicated non-root user named 'conda'. [1, 2]
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to escalate privileges within the container and potentially compromise the host system running the container. This could lead to unauthorized access, data breaches, or control over the host environment. However, the severity is classified as low, and some environments like Heroku are not affected because they do not run containers as root. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the conda-forge-webservices Docker container is running as the root user. Use the command `docker ps` to list running containers, then `docker exec -it <container_id> whoami` to see the user inside the container. If the output is 'root', the container is vulnerable. Additionally, inspect the Dockerfile or container configuration to verify if a non-root user is specified with the USER directive. [2, 1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade the conda-forge-webservices Docker container to version 2025.3.24 or later, where the container runs as a non-root user named 'conda'. If upgrading is not possible, manually create a dedicated non-root user with limited permissions inside the container and configure the container to run as that user by specifying the USER directive in the Dockerfile or container runtime configuration. This reduces the risk of privilege escalation and host compromise. [2, 1]