Insecure Permissions in Python Keyring Package Leading to World-Readable Files
Summary
DEBIAN-CVE-2012-5578: Python keyring has insecure permissions on new databases allowing world-readable files to be created. Affects python-keyring versions < 0.9.2-1.1. Fixed in 0.9.2-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Keyring package is a library designed to provide a simple interface for accessing and managing credentials securely. It allows applications to store and retrieve passwords and other sensitive information in a secure manner. However, the package has been found to have a vulnerability that affects the permissions of new databases, potentially exposing sensitive data to unauthorized access.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2012-5578 arises from insecure permissions on newly created databases within the Python Keyring package. This flaw allows for the creation of world-readable files, which means that any user on the system can access these files, leading to potential data breaches. The vulnerability affects multiple versions of the package across various Debian releases, making it a significant concern for users relying on this library for secure credential management.
How To Fix
Minimum fixed version
0.9.2-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keyringTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually adjust the permissions of the database files created by the Python Keyring package to restrict access. This can be done using the command: 'chmod 600 <database_file>', where <database_file> is the path to the specific database file. However, this is not a permanent solution and updating the package is recommended.
Conclusion
The Python Keyring package has a critical vulnerability that allows for insecure permissions on newly created databases, potentially exposing sensitive information. Users are strongly advised to update to the patched version 0.9.2-1.1 to mitigate this risk. Temporary workarounds can be applied, but a permanent fix through updating is essential for maintaining security.
See every vulnerability recorded for python-keyring →
FAQ
The vulnerability allows unauthorized users to read sensitive information stored in the database files, which can lead to data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, not updating the package poses a risk of exposing sensitive data to unauthorized users, which can lead to security incidents.
If immediate updates are not possible, ensure to restrict file permissions manually as a temporary workaround until you can apply the update.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2012-5578.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-keyring.
