OpenSSL Configuration Vulnerability in conda-forge on Microsoft Windows

CVE-2025-35471

What is CVE-2025-35471?

The conda-forge openssl-feedstock prior to version 066e83c on Microsoft Windows is susceptible to an improper configuration vulnerability. This flaw allows non-privileged local users to modify the OPENSSLDIR file path, leading to the potential execution of arbitrary code. By crafting a malicious openssl.cnf file within this directory, attackers can escalate their actions to execute code with the privileges of the user or process loading the affected DLLs. Users of impacted versions, including Miniforge before 24.5.0, should take immediate measures to update their installations and mitigate the risk.

References