{"id":182333,"date":"2026-06-27T20:48:06","date_gmt":"2026-06-27T18:48:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org"},"modified":"2026-06-27T20:48:06","modified_gmt":"2026-06-27T18:48:06","slug":"bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","title":{"rendered":"O bre\u0219\u0103 \u00een infrastructura Python permitea \u00eenlocuirea link-urilor pentru lans\u0103ri de pe site-ul python.org.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Organiza\u021bia Python Software Foundation a dezv\u0103luit o vulnerabilitate critic\u0103 \u00een API-ul de gestionare a lans\u0103rilor, care putea fi utilizat\u0103 pentru a ataca infrastructura proiectului Python. Vulnerabilitatea permitea ocolirea sistemului de autentificare \u0219i conectarea la API-ul de gestionare a lans\u0103rilor cu drepturi de administrator prin trimiterea unei cereri cu orice cheie \u0219i specificarea unuia dintre administratorii \u00een c\u00e2mpul de nume utilizator. <\/p>\n

Drepturile ob\u021binute \u00een urma exploat\u0103rii cu succes a vulnerabilit\u0103\u021bii ofereau atacatorului posibilitatea de a modifica linkurile c\u0103tre lans\u0103rile Python \u0219i metadatele pentru verificarea corectitudinii fi\u0219ierelor desc\u0103rcate, publicate pe pagina python.org\/downloads. Cu toate acestea, vulnerabilitatea nu permitea modificarea con\u021binutului fi\u0219ierelor existente cu lans\u0103rile. <\/p>\n

Auditul bazei de date \u0219i al jurnalelor nu a g\u0103sit indicii ale exploat\u0103rii vulnerabilit\u0103\u021bii. De asemenea, se presupune c\u0103 \u00eenlocuirea linkurilor c\u0103tre lans\u0103ri nu ar fi putut r\u0103m\u00e2ne neobservat\u0103, deoarece mul\u021bi furnizori utilizeaz\u0103 suplimentar un sistem de verificare criptografic\u0103 a codului Sigstore \u0219i validarea cu ajutorul cheilor PGP la desc\u0103rcare.<\/p>\n

Vulnerabilitatea a fost prezent\u0103 \u00een cod din 2014 \u0219i a fost provocat\u0103 de amestecarea \u00eentr-un singur cod a handler-elor pentru accesul oaspe\u021bilor \u0219i autentificarea prin cheie pentru API. \u00cen cazul unei erori de autentificare prin cheie pentru accesul la API, codul revenea la utilizarea accesului de oaspete. <\/p>\n

Vulnerabilitatea a fost descoperit\u0103 pe 23 februarie \u0219i a fost remediat\u0103 a doua zi, dup\u0103 care au fost efectuate mai multe verific\u0103ri ale integrit\u0103\u021bii infrastructurii: pe 25 februarie au fost analizate jurnalele \u0219i copiile de rezerv\u0103 ale bazei de date, toate resursele disponibile pentru desc\u0103rcare au fost verificate utiliz\u00e2nd semn\u0103turi digitale din jurnalul Sigstore \u0219i chei PGP, iar propria echip\u0103 a efectuat un audit al bazei de cod a serviciilor utilizate. Pe 23 aprilie, baza de cod a fost suplimentar verificat\u0103 cu ajutorul instrumentelor AI, iar pe 1 iunie a fost implicat\u0103 compania Trail of Bits pentru un audit extern al infrastructurii python.org \u0219i proceselor de formare a lans\u0103rilor Python.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a API \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u043b\u044e\u0431\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u043f\u043e\u043b\u0435 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182333","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Securitate compromis\u0103 \u00een infrastructura Python, care permitea \u00eenlocuirea linkurilor c\u0103tre lans\u0103ri pe site-ul python.org | ProHoster","description":"Organiza\u021bia Python Software Foundation a dezv\u0103luit o vulnerabilitate critic\u0103 \u00een API-ul de gestionare a lans\u0103rilor, care putea fi utilizat\u0103 pentru a ataca infrastructura proiectului Python.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0440\u0435\u0448\u044c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 Python, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 python.org | ProHoster","og:description":"\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-27T18:48:06+00:00","article:modified_time":"2026-06-27T18:48:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182333","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:14","updated":"2026-08-05 12:22:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=182333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=182333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=182333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=182333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}