PT-2019-6792 · Python · Python Keyring Lib

Vincent Danen · Publicado 2019-10-28 · Atualizado 2020-03-11 · CVE-2012-5577

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python keyring lib versions prior to 0.10

Description The issue concerns the Python keyring library, where versions before 0.10 created keyring files with world-readable permissions. This could potentially expose sensitive information.

Recommendations For versions prior to 0.10, update to version 0.10 or later to ensure keyring files are created with appropriate permissions, restricting access to sensitive information.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2012-5577

GHSA-P86X-652P-6385

PYSEC-2019-181

Produtos afetados

Python Keyring Lib

Referências · 14

• https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2019-181.yaml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5577 · Aviso do Fabricante
• https://bitbucket.org/kang/python-keyring-lib/commits/049cd181470f1ee6c540e1d64acf1def7b1de0c1 · Correção
• https://github.com/advisories/GHSA-p86x-652p-6385 · Nota
• http://openwall.com/lists/oss-security/2012/11/27/3 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-181 · Aviso do Fabricante
• https://bitbucket.org/kang/python-keyring-lib/issue/67/set-go-rwx-on-keyring_passcfg · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5577 · Nota
• https://osv.dev/vulnerability/CVE-2012-5577 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p86x-652p-6385 · Aviso do Fabricante
• https://t.me/cibsecurity/7710 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2012-5577 · Nota de Segurança
• https://bitbucket.org/kang/python-keyring-lib · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-5577 · Aviso do Fabricante