{"id":117354,"date":"2024-07-12T09:43:01","date_gmt":"2024-07-12T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python"},"modified":"2024-07-12T09:43:01","modified_gmt":"2024-07-12T07:43:01","slug":"utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","title":{"rendered":"GitHubi projekt Python t\u00e4ieliku juurdep\u00e4\u00e4su tokend lekitamise juhtum","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

JFrog'i teadlased avastasid Docker-pildi \"cabotage-app\" koostisosast administraatori\u00f5igustega juurdep\u00e4\u00e4suandeid Python, PyPI ja Python Software Foundation'i hoidlatele GitHubis. Juurdep\u00e4\u00e4sutaotlus leiti binaarfailist \"__pycache__\/build.cpython-311.pyc\", mis sisaldas vahem\u00e4llu salvestatud kompileeritud bytecode'i.

\"GitHubi<\/center> <\/p>\n

PyPI hoidla esindajate s\u00f5nul loodi token 2023. aastal arendaja ewdurbin (Ee Durbin) jaoks, kes on Python Software Foundation'is infrastruktuuri direktor. Token andis administraatori\u00f5igustega juurdep\u00e4\u00e4su k\u00f5igile projekti hoidlatele ja organisatsioonidele, sealhulgas k\u00f5igile pypi, python, psf ja pypa organisatsioonide hoidlatele. Probleemne Docker'i pilt koos tokeniga avaldati Docker Hub'i kataloogis 3. m\u00e4rtsil 2023 ning eemaldati 11. juunil 2024, olles seega 16 kuud avatud juurdep\u00e4\u00e4su all. Token t\u00fchistati 28. juunil. <\/p>\n

T\u00e4psemalt puudub probleemse bytecode'i genereerimiseks kasutatud allikaid sisaldavates saadaval olevates allikakoodides viide juurdep\u00e4\u00e4suandele. Koodi autor selgitas, et cabotage-app5 arendamise k\u00e4igus kohtas ta oma kohalikus s\u00fcsteemis GitHubi API-sse juurdep\u00e4\u00e4su intensiivsuse piirangute t\u00f5ttu automaatsete failide laadimise funktsiooni t\u00e4itmisel ning et v\u00e4ltida anon\u00fc\u00fcmsete taotluste piiranguid GitHubis, lisas ta ajutiselt oma t\u00f6\u00f6keskkonna juurdep\u00e4\u00e4suande koodi. Enne koodi avaldamist eemaldati juurdep\u00e4\u00e4suanne, kuid arendaja ei arvesse, et viide juurdep\u00e4\u00e4suandele oli vahem\u00e4llu salvestatud eelkompileeritud bytecode'i faili, mis hiljem j\u00f5udis docker-pilti. def _fetch_github_file( \u2014 github_repository='owner\/repo', ref='main', access_token=None, filename='Dockerfile' + github_repository='owner\/repo', + ref='main', + access_token='0d6a9bb5af126f73350a2afc058492765446aaad', + filename='Dockerfile', ): <\/p>\n

Python'i arendajate poolt GitHub'i hoidlate aktiivsuse suhtes l\u00e4bi viidud audit ei tuvastanud kolmandate osapoolte proovimist juurdep\u00e4\u00e4suks avaldatud tokeni kaudu. Arvestades, et alates 2017. aastast on GitHub CPython'i arendamise peamine platvorm, oleks tokeni sattumine pahatahtlike k\u00e4tesse v\u00f5inud viia kogu Python'i ja PyPI hoidla arendamiseks kasutatava infrastruktuuri t\u00e4ieliku kompomitsemise ning v\u00f5imalike tagavarakoodide integreerimise katseteni CPython'i ja PyPI pakihaldurisse. <\/p>\n

Juhtum r\u00f5hutab lekkimise anal\u00fc\u00fcsi t\u00e4htsust mitte ainult l\u00e4htekoodis, konfiguratsioonifailides ja keskkonnamuutujates, vaid ka binaarfailides. Python'i kontekstis soovitatakse kasutajatel samuti t\u00e4helepanu p\u00f6\u00f6rata laaditavates projektides pyc-failide olemasolule, sest need failid v\u00f5ivad sisaldada varjatud muudatusi, mis puuduvad l\u00e4htekoodist.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 JFrog \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u0430 «cabotage-app» \u0442\u043e\u043a\u0435\u043d, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Python, PyPI \u0438 Python Software Foundation \u043d\u0430 GitHub. \u0422\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d \u0432 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u043c \u0444\u0430\u0439\u043b\u0435 «__pycache__\/build.cpython-311.pyc» \u0441 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0441\u043a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u0430\u0439\u0442\u043a\u043e\u0434\u043e\u043c. \u041f\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044e \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0435\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f PyPI \u0442\u043e\u043a\u0435\u043d \u0431\u044b\u043b \u0441\u043e\u0437\u0434\u0430\u043d \u0432 2023 \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 ewdurbin (Ee Durbin), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117355,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117354","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tokeni lekkimine, mis annab t\u00e4ieliku ligip\u00e4\u00e4su Python'i projekti GitHub'i hoidlatele | ProHoster","description":"JFrogi teadlased avastasid Docker-pildis \"cabotage-app\" tokeni, mis annab administraatori \u00f5iguste kaudu ligip\u00e4\u00e4su Python'i, PyPI ja Python Software Foundation'i hoidlatele GitHub'is.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0442\u043e\u043a\u0435\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a GitHub-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 JFrog \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u0430 "cabotage-app" \u0442\u043e\u043a\u0435\u043d, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c Python, PyPI \u0438 Python Software Foundation \u043d\u0430 GitHub.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-12T07:43:01+00:00","article:modified_time":"2024-07-12T07:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 04:04:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:04:30","updated":"2026-01-23 04:04:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=117354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/117354\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/117355"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=117354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=117354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=117354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}