CVE-2012-5578: Incorrect Default Permissions in keyring
Summary
CVE-2012-5578: Incorrect Default Permissions in keyring. Affects keyring versions < 0.10. Fixed in 0.10. How to fix ↓
Also tracked for
- python-keyring · Debian:11
The same CVE-2012-5578 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python keyring is a package available on PyPI that provides a way to store and access passwords securely. It is commonly used in Python applications to manage credentials for various services. The keyring package allows users to create and manage keyring databases, which are used to store sensitive information such as passwords. However, a vulnerability exists in the package where new databases are created with insecure permissions, allowing world-readable files to be created. This can lead to unauthorized access to sensitive information stored in the keyring databases.
Vulnerability Detail
The vulnerability in the keyring package arises from the incorrect default permissions set on new databases. When a new keyring database is created, it is given world-readable permissions, which means that any user on the system can read the contents of the database file. This can be a serious security issue as it allows unauthorized users to access sensitive information, such as passwords, stored in the keyring databases. The vulnerability has a CVSS score of 6.2, indicating a moderate severity level.
How To Fix
Latest published version: 25.7.0 as of 22 Oct 2026
pip install --upgrade "keyring==25.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10
This is the first release that contains the fix.
pip install --upgrade "keyring==0.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually change the permissions of the keyring databases to restrict access. This can be done by running the following command:
chmod 600 <path_to_keyring_database>
Conclusion
In conclusion, the keyring package has a vulnerability that allows world-readable files to be created, potentially exposing sensitive information stored in keyring databases. Users can fix this vulnerability by updating to version 0.10 or later. Alternatively, they can apply a workaround by manually changing the permissions of the keyring databases. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keyring →
FAQ
The vulnerability allows unauthorized users to read sensitive information stored in keyring databases, such as passwords.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating the keyring package to version 0.10 or later.
Yes, as a workaround, you can manually change the permissions of the keyring databases to restrict access.
The vulnerability has a CVSS score of 6.2, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for keyring.
