feat(threat_intel): add conda/pixi supply-chain catalogs (CVE-2025-27510 + 7ASecurity audit cluster)#37
Closed
jviehhauser wants to merge 2 commits into
Closed
Conversation
…catalog Catalogs the GHSA-vwfh-m3q7-9jpw dependency-confusion RCE in conda-forge-metadata <=0.4.1. The package declares an optional dependency on `conda-oci-mirror` (an unregistered PyPI name) under its `[oci]` extras; an attacker who claimed that PyPI name before conda-forge did could RCE on anyone running `pip install conda-forge-metadata[oci]`. The fix was applied upstream by registering the placeholder name, so affected installed releases (0.3.0 and 0.4.1 — the only two releases at or below 0.4.1 per PyPI history) remain useful to flag on inventory scans. Ecosystem is `pypi` because conda-forge-metadata ships via PyPI rather than via the conda-forge channel. This is the first catalog covering the conda/pixi tooling supply chain; pixi users picking up conda tooling via pixi.lock's pypi section, or anyone with a `pip install conda-forge-metadata` in their environment, would surface here. Co-Authored-By: Claude <noreply@anthropic.com>
Adds threat_intel/conda-tooling-7asecurity-2025-06-14.json covering the three conda-channel-package CVEs published 2025-06-14 from the 7ASecurity OSTIF/STA-sponsored conda-forge audit (March-April 2025): - CVE-2025-32798 / GHSA-6cc8-c3c9-3rgr: conda-build <=25.3.2 arbitrary code execution via unsafe evaluation of malicious recipe selectors - CVE-2025-32799 / GHSA-h499-pxgj-qh5h: conda-build <=25.3.2 Tarslip path traversal via crafted tar entry paths - CVE-2025-49824 / GHSA-2xf4-hg9q-m58q: conda-smithy <=3.47.0 RSA PKCS#1 v1.5 padding-oracle in travis_encrypt_binstar_token All three are ecosystem:"conda" — the PyPI namesakes are inert placeholders that point readers to the conda channel, so these advisories only match against conda-meta records produced by the conda scanner added in PR perplexityai#36. Affected version arrays enumerate every conda-forge release at or below each advisory's "<=X.Y.Z" cutoff per the project convention (112 conda-build versions, 228 conda-smithy versions), pulled from the anaconda.org channel API. Match coverage verified locally: every enumerated version produces the expected hit count (1 or 2 per record), patched versions and current releases produce zero hits, wrong-ecosystem records do not match, and case-insensitive name normalization works through the existing exposure-catalog lowercase fallback. The broader 7ASecurity audit also produced infrastructure-level CVEs (CVE-2025-31484 anaconda.org token exposure, CVE-2025-49823 staged-recipes weak permissions, CVE-2025-32784/-32797 conda-smithy CI hardening) which are not catalogable as on-disk package presence; see https://conda-forge.org/blog/2025/07/16/security-audit/ for the full audit summary. Co-Authored-By: Claude <noreply@anthropic.com>
jviehhauser
changed the title
6 tasks
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two exposure catalogs covering the conda/pixi supply chain, sourced from public GHSAs / CVEs / the conda-forge 2025 security audit.
threat_intel/conda-forge-metadata-2025-03-04.json— PyPIOne entry, ecosystem
pypi:conda-forge-metadata≤0.4.1 dependency-confusion RCE via the unregisteredconda-oci-mirroroptional dep ([oci]extras). CVSS 9.3 critical, published 2025-03-04. Fixed upstream by claiming the placeholder PyPI name (no version bump onconda-forge-metadataitself); affected installed releases are0.3.0and0.4.1per PyPI release history.threat_intel/conda-tooling-7asecurity-2025-06-14.json— CondaThree entries, ecosystem
conda, all published 2025-06-14 from the 7ASecurity OSTIF/STA-sponsored conda-forge audit (March–April 2025):These are properly
ecosystem: "conda"because bothconda-buildandconda-smithyhave no real PyPI distribution — their PyPI namesakes are inert placeholders that point readers to the conda channel. The advisories only match against conda-meta records produced by the conda scanner added in #36, so these entries are inert until that PR merges. Affected version arrays enumerate every conda-forge release at or below each advisory's<=X.Y.Zcutoff (112 conda-build versions, 228 conda-smithy versions) per the project'slaravel-lang-style "enumerate everything affected" convention; lists were pulled from the anaconda.org channel API.Why these two and not more
I checked harder for additional conda-channel compromises before settling on this set:
opensslconda-meta version per se, so it doesn't map to bumblebee's package-presence model.The conda package manager itself (the
condapackage) had no relevant GHSA at the time of authoring.Match verification (local)
Each catalog was loaded through
internal/exposureand probed with synthetic records:Relationship to #36
Independent on the PyPI side (the
conda-forge-metadataentry matches against the existing PyPI scanner today). The conda-side entries are declarative data that activates the moment the conda scanner in #36 merges — no further changes needed.Test plan
bumblebee scan --exposure-catalog ./threat_intel/...without parse errorsgo test ./internal/exposurepasses🤖 Generated with Claude Code