PT-2019-6792 · Python · Python Keyring Lib

Vincent Danen · Published 2019-10-28 · Updated 2020-03-11 · CVE-2012-5577

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python keyring lib versions prior to 0.10

Description The issue concerns the Python keyring library, where versions before 0.10 created keyring files with world-readable permissions. This could potentially expose sensitive information.

Recommendations For versions prior to 0.10, update to version 0.10 or later to ensure keyring files are created with appropriate permissions, restricting access to sensitive information.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2012-5577

GHSA-P86X-652P-6385

PYSEC-2019-181

Affected Products

Python Keyring Lib

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5577 · Vendor Advisory
• https://bitbucket.org/kang/python-keyring-lib/commits/049cd181470f1ee6c540e1d64acf1def7b1de0c1 · Patch
• https://osv.dev/vulnerability/PYSEC-2019-181 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5577 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p86x-652p-6385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5577 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-5577 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2019-181.yaml · Note
• https://github.com/advisories/GHSA-p86x-652p-6385 · Note
• http://openwall.com/lists/oss-security/2012/11/27/3 · Note
• https://bitbucket.org/kang/python-keyring-lib/issue/67/set-go-rwx-on-keyring_passcfg · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5577 · Note
• https://t.me/cibsecurity/7710 · Telegram Post
• https://bitbucket.org/kang/python-keyring-lib · Note