Insecure Permissions in Python Keyring: CVE-2012-5578
Summary
CVE-2012-5578: Python keyring has insecure permissions on new databases allowing world-readable files to be created. Affects python-keyring versions < 0.9.2-1.1. Fixed in 0.9.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Keyring is a library that provides a way to access the system's keyring service to store and retrieve credentials securely. It is widely used in applications that require secure storage of sensitive information, such as passwords and API keys. However, the library has been found to have a critical vulnerability that allows for the creation of world-readable files, potentially exposing sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability identified as CVE-2012-5578 arises from insecure permissions on newly created databases by Python Keyring. When a new database is created, it may have permissions set in such a way that it becomes accessible to all users on the system. This can lead to unauthorized access to sensitive information stored within the keyring, posing a significant security risk. The vulnerability affects multiple versions of the package across various Debian ecosystems, and it is crucial to address it to prevent potential data breaches.
How To Fix
Minimum fixed version
0.9.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keyringTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to manually change the permissions of the keyring database files to restrict access. This can be done using the following command: 'chmod 600 /path/to/keyring/database'. Replace '/path/to/keyring/database' with the actual path to your keyring database files. This command ensures that only the owner has read and write permissions, preventing unauthorized access.
Conclusion
CVE-2012-5578 highlights a significant security issue within the Python Keyring library, where insecure permissions can lead to unauthorized access to sensitive data. It is essential for users to upgrade to the fixed version to ensure the security of their applications. Additionally, temporary workarounds can be employed to mitigate risks until an upgrade is possible.
See every vulnerability recorded for python-keyring →
FAQ
CVE-2012-5578 is a vulnerability in the Python Keyring library that allows for the creation of world-readable files, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is unauthorized access to sensitive information stored in the keyring, which could lead to data breaches and compromised accounts.
Yes, you can change the permissions of the keyring database files to restrict access temporarily until you can upgrade the package.
The CVSS score for CVE-2012-5578 is 6.2, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-keyring.
