{"id":182333,"date":"2026-06-27T20:48:06","date_gmt":"2026-06-27T18:48:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org"},"modified":"2026-06-27T20:48:06","modified_gmt":"2026-06-27T18:48:06","slug":"bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","title":{"rendered":"Python infrastruktuuri haave, mis v\u00f5imaldas asendada linke versioonidele python.org lehel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python Software Foundation teatas kriitilisest turvaveast API-s, mille kaudu saab haldada versioone, mida oleks saanud kasutada r\u00fcnnakuks Python projekti infrastruktuurile. See haavatavus v\u00f5imaldas m\u00f6\u00f6da minna autentimiss\u00fcsteemist ja p\u00e4\u00e4seda API-le, mille kaudu haldate versioone, administraatori \u00f5igustega, saates p\u00e4ringu mis tahes v\u00f5tmega ja m\u00e4\u00e4rates \u00fche administraatori kasutajanime v\u00e4ljal. <\/p>\n

Eduka haavatavuse \u00e4rakasutamise korral saadud \u00f5igused andsid r\u00fcndajale v\u00f5imaluse muuta Python'i versioonide linke ja metaandmeid, mis tagavad allalaaditud failide \u00f5igsuse, mis olid avaldatud lehel python.org\/downloads. Samas ei lubanud haavatavus muuta juba olemasolevate versioonifailide sisu. <\/p>\n

Andmebaasi ja logide audit ei tuvastanud mingeid j\u00e4lgi haavatavuse \u00e4rakasutamisest. Samuti arvatakse, et versioonide linkide varguse ei saanud j\u00e4\u00e4da m\u00e4rkamatuks, kuna paljud teenusepakkujad kasutavad allalaadimise ajal t\u00e4iendavalt kr\u00fcptograafilist koodi verifikatsioonis\u00fcsteemi Sigstore ja PGP-v\u00f5tmete kontrollimist.<\/p>\n

Turvalisus oli olemas koodis alates 2014. aastast ning see oli tingitud k\u00fclalisautorite ja API v\u00f5tme autentimiseks m\u00f5eldud t\u00f6\u00f6tlejate segamisest \u00fches ja samas koodis. Kui autentimisel esines t\u00f5rge API p\u00e4\u00e4suv\u00f5tme puhul, siis kood l\u00fclitati tagasi k\u00fclalisjuurdep\u00e4\u00e4sule. <\/p>\n

Turvalisus tuvastati 23. veebruaril ja k\u00f5rvaldatakse j\u00e4rgmisel p\u00e4eval, p\u00e4rast mida viidi l\u00e4bi mitu infrastruktuuri terviklikkuse kontrolli: 25. veebruaril anal\u00fc\u00fcsiti logisid ja andmebaasi varukoopiaid, k\u00f5ik allalaadimiseks saadaval olevad ressursid kontrolliti digitaalallkirjade abil Sigstore logi ja PGP-v\u00f5tmete abil, enda j\u00f5ududega viidi l\u00e4bi kasutatavate teenuste koodibaasi audit. 23. aprillil kontrolliti koodibaasi t\u00e4iendavalt AI-t\u00f6\u00f6riistade abil ning 1. juunil kaasati v\u00e4lise auditi tegemiseks python.org infrastruktuurile ja Python'i versioonide loomise protsessidele ettev\u00f5te Trail of Bits.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a API \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u043b\u044e\u0431\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u043f\u043e\u043b\u0435 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182333","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Python infrastruktuuri haavatavus, mis v\u00f5imaldas asendada lingid versioonidele veebilehel python.org | ProHoster","description":"Python Software Foundation teatas kriitilisest haavatavusest versioonihaldus-API-s, mida sai kasutada r\u00fcnnakuks Python projekti infrastruktuurile. Haavatavus v\u00f5imaldas v\u00e4ltida autentimiss\u00fcsteemi ja ligip\u00e4\u00e4su versioonihaldus-API-le administraatori \u00f5igustes, saates p\u00e4ringu mistahes v\u00f5tmega ning m\u00e4\u00e4rates kasutajanime v\u00e4ljal \u00fche administraatori. Saadud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0440\u0435\u0448\u044c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 Python, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 python.org | ProHoster","og:description":"\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a API \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u043b\u044e\u0431\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u043f\u043e\u043b\u0435 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-27T18:48:06+00:00","article:modified_time":"2026-06-27T18:48:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}