World-Readable Permissions Vulnerability in Python Keyring Package
Summary
DEBIAN-CVE-2012-5577: Python keyring lib before 0.10 created keyring files with world-readable permissions. Affects python-keyring versions < 0.9.2-1.1. Fixed in 0.9.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Keyring library is a popular tool used for accessing and storing credentials securely. It provides a simple API to manage passwords and other sensitive information, allowing developers to integrate secure credential storage into their applications. However, prior to version 0.10, the library had a significant security flaw that allowed keyring files to be created with world-readable permissions, exposing sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2012-5577 affects the Python Keyring library versions before 0.10. It originates from improper file permission settings, which result in keyring files being created with permissions that allow any user on the system to read them. This can lead to unauthorized access to sensitive credentials stored by applications using the library, potentially compromising user accounts and sensitive data.
How To Fix
Minimum fixed version
0.9.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keyringTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually change the permissions of the keyring files after they are created to restrict access. This can be done using the command: chmod 600 /path/to/keyring/file where '/path/to/keyring/file' should be replaced with the actual path to the keyring file.
Conclusion
The Python Keyring library has a vulnerability that allows sensitive keyring files to be created with world-readable permissions. Updating to version 0.9.2-1.1 or later is essential to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-keyring →
FAQ
The Python Keyring library is a tool that provides a way to access and store credentials securely, allowing developers to manage passwords and sensitive information in their applications.
The vulnerability allows keyring files to be created with world-readable permissions, exposing sensitive credentials to any user on the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive credentials, potentially compromising user accounts and data.
It is recommended to regularly check for updates and apply them promptly to ensure that you are protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-keyring.
