Threats tagged 'python packaging'

A vulnerability in legacy Python packages arises from bootstrap scripts that fetch and execute installation code from the domain python-distribute.org, which is no longer controlled by the original maintainers and is available for takeover. This can lead to arbitrary code execution if an attacker acquires the domain and serves malicious scripts. Affected packages include tornado, pypiserver, and others. The issue is due to the use of hardcoded domains in bootstrap scripts for the obsolete 'distribute' package. No exploits have been observed in the wild, but the risk is significant given the trust in PyPI packages and the potential for supply chain compromise.

EPSS 1.7%Vulnerability#python packaging#supply chainGermany+4