CVE-2012-4571: Python Keyring 0.9.1 CryptedFileKeyring Password Encryption Brute-Force Vulnerability
Summary
CVE-2012-4571: Python Keyring does not securely initialize encryption cipher. Affects keyring versions < 0.9.2. Fixed in 0.9.2. How to fix ↓
Also tracked for
- python-keyring · Debian:11
The same CVE-2012-4571 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Keyring is a library that provides a way to access the system keyring service from Python. It allows developers to securely store and retrieve passwords, encryption keys, and other sensitive information. The CryptedFileKeyring is a feature in Python Keyring that allows users to encrypt their passwords and store them in a file. However, in version 0.9.1, the cipher used for encryption is not securely initialized, making it easier for local users to obtain passwords through a brute-force attack.
Vulnerability Detail
The vulnerability in Python Keyring 0.9.1 lies in the insecure initialization of the cipher when encrypting passwords for CryptedFileKeyring files. This flaw allows local users to potentially obtain passwords by performing a brute-force attack. By repeatedly trying different password combinations, an attacker can decrypt the encrypted passwords and gain unauthorized access to sensitive information. This vulnerability poses a significant risk to systems where Python Keyring 0.9.1 is used to store passwords or other confidential data.
How To Fix
Latest published version: 25.7.0 as of 22 Oct 2026
pip install --upgrade "keyring==25.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.2
This is the first release that contains the fix.
pip install --upgrade "keyring==0.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Python Keyring version 0.9.1 is vulnerable to a brute-force attack due to insecure cipher initialization when encrypting passwords for CryptedFileKeyring files. This can lead to unauthorized access to sensitive information. Users are advised to upgrade to Python Keyring version 0.9.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keyring →
FAQ
Python Keyring is a library that provides a way to access the system keyring service from Python. It allows developers to securely store and retrieve passwords, encryption keys, and other sensitive information.
The CryptedFileKeyring is a feature in Python Keyring that allows users to encrypt their passwords and store them in a file. This feature provides an additional layer of security for storing sensitive information.
This vulnerability allows local users to potentially obtain passwords by performing a brute-force attack. By decrypting the encrypted passwords, an attacker can gain unauthorized access to sensitive information stored in Python Keyring.
To fix this vulnerability, users should upgrade to Python Keyring version 0.9.2 or later. The updated version addresses the insecure cipher initialization issue and ensures that passwords are encrypted securely.
Currently, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Python Keyring to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for keyring.
