PT-2012-5482 · Python · Python Keyring

Geser + 1 · Publicado 2012-11-30 · Atualizado 2022-05-17 · CVE-2012-4571

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P

Name of the Vulnerable Software and Affected Versions Python Keyring version 0.9.1

Description The issue arises from the insecure initialization of the cipher when encrypting passwords for CryptedFileKeyring files. This makes it easier for local users to obtain passwords via a brute-force attack.

Recommendations For Python Keyring version 0.9.1, consider updating to a newer version that securely initializes the cipher for encrypting passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-310

Identificadores relacionados

CVE-2012-4571

GHSA-P3H7-3C45-QJ4V

PYSEC-2012-8

Produtos afetados

Python Keyring

Referências · 17

• https://github.com/jaraco/keyring/commit/a76942672f6ac85a88bd9b9ed31fd133119b7702 · Nota
• https://github.com/jaraco/keyring · Nota
• https://github.com/jaraco/keyring/commit/cbf509b0386c3063d8b2879ce72d78ac18023f72 · Nota
• https://github.com/jaraco/keyring/commit/56272d908ba7a3fe4ebb6d6e87a7cc569f4726ac · Nota
• https://github.com/jaraco/keyring/commit/cc1ead78d1e3fab9fa8bb0b4bb334cb82d35db52 · Nota
• https://github.com/jaraco/keyring/commit/162f2ed0e39e16d561732b9fad8af6cd2341d7bd · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2012-8.yaml · Nota
• http://ubuntu.com/usn/USN-1634-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/10/31/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4571 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p3h7-3c45-qj4v · Aviso do Fabricante
• https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845 · Nota
• https://osv.dev/vulnerability/CVE-2012-4571 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-8 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-4571 · Aviso do Fabricante