The developers of the Python Package Index (PyPI) repository reported a security issue in the implementation of the "Organization Team" feature, which allows multiple developers to collaborate on a project within PyPI. The problem identified was that privileges delegated to a user as a member of the "Organization Team" persisted even after the user was removed from the organization. The vulnerability in PyPI was fixed two hours after the issue was reported. An audit found no unauthorized actions related to the use of unrevoked access rights.
The developers of the crates.io repository, which distributes packages for the Rust language, also reported a security-related incident. In the crates.io infrastructure, when a backend error occurs, the information about requests being processed at the time of the issue is sent to the monitoring service Sentry. The issue is linked to the fact that among the data sent was a field containing the Cookie "cargo_session", in which a session key identifying the user was stored. An unauthorized individual who obtained this key could perform any actions in the user's active session.
It is noted that access to server Sentry monitoring was limited to select team members managing the project’s infrastructure and the crates.io repository, who already had privileged access to the operational servers of crates.io. No evidence was found that the session keys logged were used by anyone. After the issue was resolved, such Cookies were removed from all event records in Sentry, and related active user sessions were terminated.
Source: opennet.ru
