{"id":123558,"date":"2025-04-16T15:05:07","date_gmt":"2025-04-16T13:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inczidenty-s-bezopasnostyu-v-repozitoriyah-pypi-i-crates-io"},"modified":"2025-04-16T15:05:07","modified_gmt":"2025-04-16T13:05:07","slug":"inczidenty-s-bezopasnostyu-v-repozitoriyah-pypi-i-crates-io","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/inczidenty-s-bezopasnostyu-v-repozitoriyah-pypi-i-crates-io","title":{"rendered":"Incidents de s\u00e9curit\u00e9 dans les d\u00e9p\u00f4ts PyPI et crates.io","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Les d\u00e9veloppeurs du d\u00e9p\u00f4t de packages Python PyPI (Python Package Index) ont signal\u00e9 un probl\u00e8me de s\u00e9curit\u00e9 dans la mise en \u0153uvre de la fonctionnalit\u00e9 \u00ab Organization Team \u00bb, qui permet de former une \u00e9quipe de plusieurs d\u00e9veloppeurs travaillant ensemble sur un projet dans PyPI. Le probl\u00e8me identifi\u00e9 r\u00e9side dans le fait que les privil\u00e8ges d\u00e9l\u00e9gu\u00e9s \u00e0 un utilisateur en tant que membre de \u00ab Organization Team \u00bb restaient actifs m\u00eame apr\u00e8s la suppression de l'utilisateur de l'organisation. La vuln\u00e9rabilit\u00e9 dans PyPI a \u00e9t\u00e9 corrig\u00e9e deux heures apr\u00e8s le signalement du probl\u00e8me. Un audit effectu\u00e9 n'a r\u00e9v\u00e9l\u00e9 aucune action non autoris\u00e9e li\u00e9e \u00e0 l'utilisation des droits d'acc\u00e8s non r\u00e9voqu\u00e9s. <\/p>\n

Les d\u00e9veloppeurs du d\u00e9p\u00f4t crates.io, qui distribue des packages en langage Rust, ont \u00e9galement signal\u00e9 un incident li\u00e9 \u00e0 la s\u00e9curit\u00e9. Dans l'infrastructure de crates.io, en cas d'erreurs c\u00f4t\u00e9 backend, les informations sur les requ\u00eates trait\u00e9es au moment de l'erreur sont envoy\u00e9es au service de surveillance Sentry. Le probl\u00e8me est que parmi les donn\u00e9es envoy\u00e9es, il y avait un champ contenant le Cookie \u00ab cargo_session \u00bb, qui contenait une cl\u00e9 de session identifiant l'utilisateur. Toute personne ayant obtenu cette cl\u00e9 pouvait effectuer n'importe quelle action dans la session utilisateur non termin\u00e9e. <\/p>\n

Il est not\u00e9 que l'acc\u00e8s au serveur<\/a> monitoring Sentry n'\u00e9tait accord\u00e9 qu'\u00e0 certains membres des \u00e9quipes charg\u00e9es de la maintenance de l'infrastructure du projet et du d\u00e9p\u00f4t crates.io, qui ont d\u00e9j\u00e0 un acc\u00e8s privil\u00e9gi\u00e9 aux serveurs de travail de crates.io. Il n'a pas \u00e9t\u00e9 constat\u00e9 que les cl\u00e9s de session qui se sont retrouv\u00e9es dans les journaux aient \u00e9t\u00e9 utilis\u00e9es par qui que ce soit. Apr\u00e8s la r\u00e9solution du probl\u00e8me, ces Cookies ont \u00e9t\u00e9 supprim\u00e9s de tous les enregistrements d'\u00e9v\u00e9nements dans Sentry, et les sessions utilisateurs actives associ\u00e9es ont \u00e9t\u00e9 termin\u00e9es.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 «Organization Team», \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043d\u0430\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0432 PyPI. \u0421\u0443\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043a\u0430\u043a \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0443 «Organization Team», \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0438\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PyPI \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123558","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Incidents de s\u00e9curit\u00e9 dans les d\u00e9p\u00f4ts PyPI et crates.io | ProHoster","description":"Les d\u00e9veloppeurs du d\u00e9p\u00f4t de paquets Python PyPI (Python Package Index) ont signal\u00e9 un probl\u00e8me de s\u00e9curit\u00e9 dans l'impl\u00e9mentation de la fonction \"Organisation \u00c9quipe\", permettant de constituer une \u00e9quipe de plusieurs.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/inczidenty-s-bezopasnostyu-v-repozitoriyah-pypi-i-crates-io","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 PyPI \u0438 crates.io | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 "Organization Team", \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/inczidenty-s-bezopasnostyu-v-repozitoriyah-pypi-i-crates-io","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-16T13:05:07+00:00","article:modified_time":"2025-04-16T13:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123558","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:08:59","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:15:52","updated":"2026-02-09 22:08:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=123558"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123558\/revisions"}],"predecessor-version":[{"id":160208,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123558\/revisions\/160208"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=123558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=123558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=123558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}