World-Readable Permissions Vulnerability in Python Keyring Package
Summary
CVE-2012-5577: Python keyring lib before 0.10 created keyring files with world-readable permissions. Affects python-keyring versions < 0.9.2-1.1. Fixed in 0.9.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Keyring library is a popular tool used for accessing and storing credentials securely. It provides a simple API to manage passwords and other sensitive information across various platforms. However, prior to version 0.10, the library had a significant security flaw that allowed keyring files to be created with world-readable permissions, potentially exposing sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability, identified as CVE-2012-5577, stems from the way the Python Keyring library handles file permissions when creating keyring files. Specifically, versions before 0.10 set permissions that allowed any user on the system to read these files, leading to a risk of credential exposure. This could have severe implications, especially in multi-user environments, where sensitive information could be accessed by malicious actors. The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
How To Fix
Minimum fixed version
0.9.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keyringTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to manually change the permissions of the keyring files to restrict access. This can be done using the following command in the terminal:
chmod 600 /path/to/keyring/file
Conclusion
The Python Keyring library's vulnerability (CVE-2012-5577) poses a significant risk by allowing sensitive keyring files to be world-readable. Users are strongly advised to upgrade to the latest version to mitigate this risk. In the meantime, adjusting file permissions can serve as a temporary workaround. Tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-keyring →
FAQ
CVE-2012-5577 is a vulnerability in the Python Keyring library that allows keyring files to be created with world-readable permissions, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main risk is unauthorized access to sensitive credentials stored in keyring files, which could lead to data breaches or unauthorized actions within applications.
Yes, you can manually change the permissions of the keyring files to restrict access using the chmod command.
The CVSS score for CVE-2012-5577 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-keyring.
