{"id":182333,"date":"2026-06-27T20:48:06","date_gmt":"2026-06-27T18:48:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org"},"modified":"2026-06-27T20:48:06","modified_gmt":"2026-06-27T18:48:06","slug":"bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/bresh-v-infrastrukture-python-pozvolyavshaya-podmenit-ssylki-na-relizy-na-sajte-python-org","title":{"rendered":"Nj\u00eb vrim\u00eb n\u00eb infrastruktur\u00ebn e Python, e cila lejonte z\u00ebvend\u00ebsimin e lidhjeve t\u00eb l\u00ebshimeve n\u00eb faqen python.org.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Organizata Python Software Foundation ka publikuar informacion rreth nj\u00eb vulnerabiliteti kritik n\u00eb API-n\u00eb p\u00ebr menaxhimin e publikimeve, q\u00eb mund t\u00eb p\u00ebrdorej p\u00ebr t\u00eb sulmuar infrastruktur\u00ebn e projektit Python. Vulnerabiliteti lejonte kalimin e sistemit t\u00eb autentikimit dhe lidhej me API-n\u00eb e menaxhimit t\u00eb publikimeve me t\u00eb drejta admini duke d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb me \u00e7far\u00ebdo \u00e7el\u00ebsi dhe duke caktuar nj\u00eb nga administrator\u00ebt n\u00eb fush\u00ebn e emri t\u00eb p\u00ebrdoruesit. <\/p>\n
T\u00eb drejtat e marra n\u00eb rastin e shfryt\u00ebzimit t\u00eb suksessh\u00ebm t\u00eb vulnerabilitetit i jepnin sulmuesit mund\u00ebsin\u00eb p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb lidhjet p\u00ebr publikimet Python dhe metadat\u00ebn p\u00ebr verifikimin e sakt\u00ebsis\u00eb s\u00eb skedar\u00ebve t\u00eb ngarkuar, t\u00eb vendosur n\u00eb faqen python.org\/downloads. Nd\u00ebrkoh\u00eb, vulnerabiliteti nuk lejonte ndryshimin e p\u00ebrmbajtjes s\u00eb dosjeve ekzistuese me publikimet. <\/p>\n
Auditi i baz\u00ebs s\u00eb t\u00eb dh\u00ebnave dhe log\u00ebve nuk zbuloi shenja t\u00eb shfryt\u00ebzimit t\u00eb vulnerabilitetit. Gjithashtu, supozohet se z\u00ebvend\u00ebsimi i lidhjeve p\u00ebr publikimet nuk mund t\u00eb kishte mbetur i paqart\u00eb, pasi shum\u00eb ofrues n\u00eb ngarkim p\u00ebrdorin shtes\u00eb nj\u00eb sistem verifikimi t\u00eb kodit kriptografik Sigstore dhe kontrollimin duke p\u00ebrdorur \u00e7el\u00ebsa PGP.<\/p>\n
Vulnera ka qen\u00eb n\u00eb kod q\u00eb nga viti 2014 dhe \u00ebsht\u00eb shkaktuar nga p\u00ebrzierja n\u00eb nj\u00eb kod t\u00eb vet\u00ebm t\u00eb p\u00ebrpunuesve p\u00ebr hyrjet e mysafir\u00ebve dhe autentifikimin p\u00ebrmes \u00e7el\u00ebsave p\u00ebr API. N\u00eb rast t\u00eb d\u00ebshtimit t\u00eb autentifikimit t\u00eb \u00e7el\u00ebsit p\u00ebr qasje n\u00eb API, n\u00eb kod u ekzekutua nj\u00eb rikthim p\u00ebr t\u00eb p\u00ebrdorur aksesin si mysafir. <\/p>\n
Vulnera u identifikua m\u00eb 23 shkurt dhe u eliminua dit\u00ebn pasuese, pas s\u00eb cil\u00ebs u zhvilluan disa kontrollime t\u00eb integritetit t\u00eb infrastruktur\u00ebs: m\u00eb 25 shkurt u analizuan logjet dhe kopjet rezerv\u00eb t\u00eb DB, t\u00eb gjitha burimet e disponueshme p\u00ebr shkarkim u verifikuan duke p\u00ebrdorur n\u00ebnshkrime digjitale nga logu Sigstore dhe \u00e7el\u00ebsa PGP, auditor\u00eb t\u00eb brendsh\u00ebm kryen auditimin e baz\u00ebs s\u00eb kodit t\u00eb sh\u00ebrbimeve t\u00eb p\u00ebrdorura. M\u00eb 23 prill, baza e kodit u verifikua p\u00ebrmbledh nga mjete AI, dhe m\u00eb 1 qershor p\u00ebr auditi t\u00eb jasht\u00ebm t\u00eb infrastruktur\u00ebs python.org dhe proceseve t\u00eb formimit t\u00eb versioneve Python, u angazhua kompania Trail of Bits. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"