Python vulnerability disclosure

The correct way for projects to announce vulnerabilities to vendors is oss-security. http://oss-security.openwall.org/wiki/

In this particular case, the vendors are apparently already aware, but in general oss-security does the trick.