devpi-server may leak database contents
If the replication protocol is enabled by using the primary (or deprecated master) role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially modified GET request. The leaked hashes use the argon2 algorithm, so they are not immediately at risk by brute-force methods, but dictionary …