Insecure Cipher Initialization in Python Keyring 0.9.1 - CVE-2012-4571
Summary
CVE-2012-4571: Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack. Affects python-keyring versions < 0.9.2-1. Fixed in 0.9.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Keyring is a library that provides a way to access the system's keyring service to store and retrieve credentials securely. It allows developers to manage passwords and other sensitive information without hardcoding them into applications. The library is widely used in various applications to enhance security by leveraging the underlying operating system's capabilities. However, version 0.9.1 of Python Keyring has a significant vulnerability that compromises its ability to securely encrypt passwords, making it susceptible to brute-force attacks.
Vulnerability Detail
CVE-2012-4571 arises from the insecure initialization of the cipher used for encrypting passwords in CryptedFileKeyring files. This flaw allows local users to exploit the weak encryption mechanism, potentially leading to unauthorized access to sensitive credentials. The vulnerability is rooted in the way the cipher is set up, which does not adequately protect against brute-force attacks, thereby increasing the risk of password exposure.
How To Fix
Minimum fixed version
0.9.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keyringTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using an alternative method for storing sensitive information, such as environment variables or a different secure storage solution. Additionally, limit access to the system to trusted users only to mitigate the risk of exploitation.
Conclusion
CVE-2012-4571 highlights a critical vulnerability in Python Keyring 0.9.1 that compromises the security of password storage. Upgrading to version 0.9.2-1 or later is essential to protect sensitive information from potential brute-force attacks. Users should also consider alternative storage solutions and limit system access to mitigate risks.
See every vulnerability recorded for python-keyring →
FAQ
CVE-2012-4571 is a vulnerability in Python Keyring 0.9.1 that allows local users to exploit weak encryption methods for password storage, making it easier to obtain sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to sensitive credentials stored using the affected version of Python Keyring, which could lead to data breaches or other security incidents.
Yes, you can limit access to the system to trusted users and consider using alternative secure storage methods for sensitive information until an upgrade is possible.
After upgrading, ensure that all stored credentials are re-encrypted using the new version to benefit from the improved security measures.
Related vulnerabilities
Recent vulnerabilities recorded for python-keyring.
