{"id":182333,"date":"2026-06-27T20:48:06","date_gmt":"2026-06-27T18:48:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org"},"modified":"2026-06-27T20:48:06","modified_gmt":"2026-06-27T18:48:06","slug":"bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","title":{"rendered":"Varnostna luknja v infrastrukturi Pythona, ki je omogo\u010dila zamenjavo povezav do izdaj na spletnem mestu python.org","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Organizacija Python Software Foundation je razkrila informacije o kriti\u010dni ranljivosti v API-ju za upravljanje izdaj, ki se je lahko izkoristila za napad na infrastrukturo projekta Python. Ranljivost je omogo\u010dila obhod avtentikacijske sistema in povezovanje na API za upravljanje izdaj z administratorskimi pravicami prek po\u0161iljanja zahteve z katerim koli klju\u010dem in navedbo enega od administratorjev v polju z imenom uporabnika. <\/p>\n

Pravice, pridobljene v primeru uspe\u0161ne izkori\u0161\u010denosti ranljivosti, so napadalcu omogo\u010dile, da je spreminjal povezave do izdaj Pythona in metapodatke za preverjanje pravilnosti prenesenih datotek, objavljenih na strani python.org\/downloads. Pri tem ranljivost ni omogo\u010dala spremembe vsebine obstoje\u010dih datotek z izdajami. <\/p>\n

Revizija baze podatkov in dnevnikov ni pokazala sledi izkori\u0161\u010denosti ranljivosti. Prav tako se predvideva, da bi zamenjava povezav do izdaj ostala neopa\u017eena, saj mnogi ponudniki pri prenosu dodatno uporabljajo sistem kriptografske verifikacije kode Sigstore in preverjanje z uporabo PGP klju\u010dev.<\/p>\n

Ranljivost je bila prisotna v kodi od leta 2014 in je bila povzro\u010dena z me\u0161anjem obdelovalcev za gostinske dostope in avtentifikacijo prek klju\u010dev za API. V primeru napake pri avtentikaciji s klju\u010dem dostopa do API, je v kodi pri\u0161lo do povratka k uporabi gostinskega dostopa. <\/p>\n

Ranljivost je bila ugotovljena 23. februarja in odpravljena dan kasneje, nato so bile izvedene \u0161tevilne preveritve celovitosti infrastrukture: 25. februarja so bili analizirani dnevniki in varnostne kopije baze podatkov, vsi dostopni viri za prenos so bili preverjeni z uporabo digitalnih podpisov iz dnevnika Sigstore in PGP klju\u010dev, lastna revizija kode uporabljenih storitev je bila izvedena. 23. aprila je bila koda dodatno preverjena s pomo\u010djo AI orodij, 1. junija pa je bila za zunanjo revizijo infrastrukture python.org in procesov oblikovanja izdaj Pythona anga\u017eirana dru\u017eba Trail of Bits.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a API \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0441 \u043b\u044e\u0431\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u0435\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u043f\u043e\u043b\u0435 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182333","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Javna ranljivost v infrastrukturi Python, ki je dovolila zamenjavo povezav na izdaje na spletnem mestu python.org | ProHoster","description":"Organizacija Python Software Foundation je razkrila informacije o kriti\u010dni ranljivosti v API-ju za upravljanje izdajami, ki se je lahko uporabljala za napad na infrastrukturo projekta Python.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0440\u0435\u0448\u044c \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 Python, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 python.org | ProHoster","og:description":"\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f Python Software Foundation \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Python.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-27T18:48:06+00:00","article:modified_time":"2026-06-27T18:48:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182333","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:14","updated":"2026-08-05 12:22:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/182333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=182333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/182333\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=182333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=182333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=182333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}