{"id":182333,"date":"2026-06-27T20:48:06","date_gmt":"2026-06-27T18:48:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org"},"modified":"2026-06-27T20:48:06","modified_gmt":"2026-06-27T18:48:06","slug":"bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","title":{"rendered":"A vulnerability in the Python infrastructure that allowed links to releases on the python.org website to be replaced.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Python Software Foundation has revealed information about a critical vulnerability in the release management API that could be exploited to attack Python's project infrastructure. This vulnerability allowed bypassing the authentication system and accessing the release management API with administrator privileges by sending a request with any key and specifying one of the administrators in the username field. <\/p>\n
The privileges obtained from successfully exploiting the vulnerability allowed the attacker to modify links to Python releases and the metadata to verify the integrity of uploaded files on the python.org\/downloads page. However, the vulnerability did not allow altering the contents of existing release files. <\/p>\n
An audit of the database and logs did not reveal any signs of exploitation of the vulnerability. It is also assumed that the substitution of release links could not go unnoticed, as many providers additionally use a cryptographic code verification system, Sigstore, and PGP key checks when downloading.<\/p>\n
The vulnerability had been present in the code since 2014 and was caused by mixing handlers for guest logins and key-based authentication for the API. In case of failure of authentication via the access key to the API, the code would fall back to using guest access. <\/p>\n
The vulnerability was identified on February 23 and was fixed the following day, after which several integrity checks of the infrastructure were performed: on February 25, logs and database backups were analyzed, all available resources for download were checked using digital signatures from the Sigstore log and PGP keys, and an internal audit of the codebase of the used services was conducted. On April 23, the codebase was additionally checked using AI tools, and on June 1, the company Trail of Bits was engaged for an external audit of the python.org infrastructure and the release process of Python. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"