CVE-2012-5577: Python keyring lib before 0.10 World-Readable Keyring Files
Summary
CVE-2012-5577: Python keyring lib before 0.10 created keyring files with world-readable permissions. Affects keyring versions < 0.10. Fixed in 0.10. How to fix ↓
Also tracked for
- python-keyring · Debian:11
The same CVE-2012-5577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python keyring library is a package available on PyPI that provides a way to store and retrieve passwords securely. It allows developers to use the operating system's keyring service to store passwords for their applications. The keyring files created by the library before version 0.10 had world-readable permissions, which means that anyone with access to the file could read its contents.
Vulnerability Detail
The vulnerability (CVE-2012-5577) in the Python keyring library allowed keyring files to be created with world-readable permissions. This means that any user on the system could potentially read the contents of these files, including sensitive information such as passwords. This vulnerability could lead to unauthorized access to the stored passwords and compromise the security of applications using the keyring library.
How To Fix
Latest published version: 25.7.0 as of 22 Oct 2026
pip install --upgrade "keyring==25.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10
This is the first release that contains the fix.
pip install --upgrade "keyring==0.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually change the permissions of the keyring files to restrict access. This can be done by setting the appropriate file permissions using the chmod command or by using a file manager with a graphical interface. The keyring files should be set to be readable only by the owner and not accessible by other users.
Conclusion
The Python keyring library before version 0.10 had a vulnerability that allowed keyring files to be created with world-readable permissions. This could lead to unauthorized access to stored passwords and compromise the security of applications. It is recommended to upgrade to version 0.10 or later of the library and regenerate any existing keyring files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keyring →
FAQ
The vulnerability allows unauthorized users to read the contents of keyring files, potentially exposing sensitive information such as passwords.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
Yes, the vulnerability has been fixed in version 0.10 of the Python keyring library. It is recommended to upgrade to this version or later to ensure the keyring files have the correct permissions.
Yes, as a workaround, you can manually change the permissions of the keyring files to restrict access. Set the file permissions to be readable only by the owner and not accessible by other users.
There are no known exploits for this vulnerability at the moment. However, it is still important to fix the vulnerability to prevent potential unauthorized access to sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for keyring.
