What is the CVSS score of CVE-2025-49824?

CVE-2025-49824 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U. EPSS exploitation probability: 0.1%.

Which versions of Oracle are affected by CVE-2025-49824?

CVE-2025-49824 is a low-severity vulnerability in conda-smithy involving information exposure (CVSS 1.7).. A patch is available.

How to fix or mitigate CVE-2025-49824?

During next maintenance window: Apply vendor patches when convenient. Verify information disclosure controls are in place.

Oracle CVE-2025-49824

EUVD-2025-18563 LOW

Information Exposure (CWE-200)

2025-06-17 security-advisories@github.com

Oracle Information Disclosure

1.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.47.1

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18563

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

LOW 1.7

DescriptionGitHub Advisory

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified as vulnerable to an Oracle Padding Attack. This vulnerability results from the use of an outdated and insecure padding scheme during RSA encryption. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key. This issue has been patched in version 3.47.1.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).