CVE-2012-4571 Python Keyring does not securely initialize encryption cipher
Local attackers can brute-force passwords stored in CryptedFileKeyring files due to insecure cipher initialization in the Python Keyring library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4571?
CVE-2012-4571 is a low-severity vulnerability in n/a, published on 30 Nov 2012. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
Weakness: CWE-310
Which versions are affected by CVE-2012-4571?
3 open source packages ship an affected version, including keyring. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keyring PyPI | All versions | 0.9.2 |
keyring PyPI | All versions | 0.9.2 |
keyring PyPI | All versions | 0.9.2 |
Products include Python Keyring.
How do I fix CVE-2012-4571?
Upgrade keyring to 0.9.2 or later.
Is CVE-2012-4571 being exploited?
There is no known exploitation of CVE-2012-4571 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2012-4571, GHSA-p3h7-3c45-qj4v, PYSEC-2012-8.