CVE-2012-5578: Insecure Permissions in Python keyring
Summary
CVE-2012-5578: Python keyring has insecure permissions on new databases allowing world-readable files to be created. Affects keyring versions < 0.10.1. Fixed in 0.10.1. How to fix ↓
Also tracked for
- python-keyring · Debian:11
The same CVE-2012-5578 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python keyring is a package that provides a way to store and retrieve passwords and other sensitive information securely. It is commonly used in Python applications to manage credentials for various services. However, a vulnerability exists in the package that allows for the creation of world-readable files due to insecure permissions on new databases.
Vulnerability Detail
The vulnerability (CVE-2012-5578) in Python keyring arises from the incorrect permissions set on newly created databases. This issue allows any user on the system to read the contents of these databases, potentially exposing sensitive information such as passwords and other credentials. The vulnerability was first published on November 25, 2019, and affects versions of keyring prior to 0.10.1.
How To Fix
Latest published version: 25.7.0 as of 22 Oct 2026
pip install --upgrade "keyring==25.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.1
This is the first release that contains the fix.
pip install --upgrade "keyring==0.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually adjust the permissions of the keyring databases to restrict access. This can be achieved by setting the appropriate file permissions using the chmod command. For example:
chmod 600 ~/.local/share/python_keyring/keyring_pass.cfg
Conclusion
In conclusion, the Python keyring package is vulnerable to an insecure permissions issue that allows for the creation of world-readable files. This can potentially expose sensitive information stored in the keyring databases. To mitigate this vulnerability, it is recommended to update the keyring package to version 0.10.1 or later. Alternatively, users can manually adjust the permissions of the keyring databases. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keyring →
FAQ
Python keyring is a package that provides a secure way to store and retrieve passwords and other sensitive information in Python applications.
The vulnerability allows for the creation of world-readable files, potentially exposing sensitive information stored in the keyring databases.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
Yes, the vulnerability can be fixed by updating the keyring package to version 0.10.1 or later.
Yes, as a workaround, users can manually adjust the permissions of the keyring databases to restrict access.
Related vulnerabilities
Recent vulnerabilities recorded for keyring.
