PT-2012-5482 · Python · Python Keyring

Geser + 1 · Published 2012-11-30 · Updated 2022-05-17 · CVE-2012-4571

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P

Name of the Vulnerable Software and Affected Versions Python Keyring version 0.9.1

Description The issue arises from the insecure initialization of the cipher when encrypting passwords for CryptedFileKeyring files. This makes it easier for local users to obtain passwords via a brute-force attack.

Recommendations For Python Keyring version 0.9.1, consider updating to a newer version that securely initializes the cipher for encrypting passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-310

Related Identifiers

CVE-2012-4571

GHSA-P3H7-3C45-QJ4V

PYSEC-2012-8

Affected Products

Python Keyring

References · 17

• http://ubuntu.com/usn/USN-1634-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4571 · Security Note
• https://osv.dev/vulnerability/GHSA-p3h7-3c45-qj4v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4571 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4571 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4571 · Vendor Advisory
• https://github.com/jaraco/keyring/commit/a76942672f6ac85a88bd9b9ed31fd133119b7702 · Note
• https://github.com/jaraco/keyring · Note
• https://github.com/jaraco/keyring/commit/cbf509b0386c3063d8b2879ce72d78ac18023f72 · Note
• https://github.com/jaraco/keyring/commit/56272d908ba7a3fe4ebb6d6e87a7cc569f4726ac · Note
• https://github.com/jaraco/keyring/commit/cc1ead78d1e3fab9fa8bb0b4bb334cb82d35db52 · Note
• https://github.com/jaraco/keyring/commit/162f2ed0e39e16d561732b9fad8af6cd2341d7bd · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2012-8.yaml · Note
• http://openwall.com/lists/oss-security/2012/10/31/8 · Note