Security-announce

Download

security-announce@python.org

July 2025

2 participants
2 discussions

PyPI Users Email Phishing Attack
by Seth Larson July 31, 2025

July 31, 2025

(also posted to https://blog.pypi.org/posts/2025-07-28-pypi-phishing-attack/ ) (Ongoing, preliminary report) PyPI has not been hacked, but users are being targeted by a phishing attack that attempts to trick them into logging in to a fake PyPI site. Over the past few days, users who have published projects on PyPI with their email in package metadata may have received an email titled: ``` [PyPI] Email verification ``` from the email address noreply(a)pypj.org. Note the lowercase j in the domain name, which is not the official PyPI domain, pypi.org. This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI. The email instructs users to follow a link to verify their email address, which leads to a phishing site that looks like PyPI but is not the official site. The user is prompted to log in, and the requests are passed back to PyPI, which may lead to the user believing they have logged in to PyPI, but in reality, they have provided their credentials to the phishing site. PyPI Admins are looking into a few methods of handling this attack, and want to make sure users are aware of the phishing attempt while we investigate different options. There is currently a banner on the PyPI homepage to warn users about this phishing attempt. Always inspect the URL in the browser before logging in. We are also waiting for CDN providers and name registrars to respond to the trademark and abuse notifications we have sent them regarding the phishing site. If you have received this email, do not click on any links or provide any information. Instead, delete the email immediately. If you have already clicked on the link and provided your credentials, we recommend changing your password on PyPI immediately. Inspect your account's Security History for anything unexpected. Seth Larson

2 1

[CVE-2025-8194] Tarfile infinite loop during parsing with negative member offset
by Seth Larson July 28, 2025

July 28, 2025

There is a HIGH severity vulnerability affecting {project}. There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: import tarfile def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2025-8194 * https://github.com/python/cpython/pull/137027

1 0