A Python package repository, PyPI (Python Package Index) developers reported a security issue in the implementation of the 'Organization Team' feature, which allows the formation of a team of multiple developers working together on a project in PyPI. The core issue identified was that the privileges delegated to a user as a member of the 'Organization Team' remained intact even after the user was removed from the organization. The vulnerability in PyPI was fixed two hours after the problem was reported. An audit found no unauthorized actions related to the use of revoked access rights.
Developers of the crates.io repository, through which Rust packages are distributed, also reported a related security incident. In the crates.io infrastructure, when errors occur on the backend side, information about the requests being processed at the time of the issue is sent to the Sentry monitoring service. The problem was that among the sent data was a field containing the Cookie 'cargo_session', which included the session key identifying the user. Any outsider who obtained this key could perform any actions within the user's ongoing session.
It is noted that access to szerverhez the Sentry monitoring service was only granted to specific team members servicing the project's infrastructure and the crates.io repository, who already had privileged access to the operational servers of crates.io. There is no evidence that the session keys logged in were used by anyone. After the issue was resolved, such cookies were removed from all event records in Sentry, and the associated active user sessions were terminated.
Forrás: opennet.ru
