CVE-2012-5578 Incorrect Default Permissions in keyring
Local attackers can read stored credentials because the Python keyring library creates database files with world-readable permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-5578?
CVE-2012-5578 is a medium-severity vulnerability in Python keyring, published on 25 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Python keyring has insecure permissions on new databases allowing world-readable files to be created
Weakness: CWE-276
Which versions are affected by CVE-2012-5578?
3 open source packages ship an affected version, including keyring. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keyring PyPI | All versions | 0.10 |
keyring PyPI | All versions | 0.10 |
keyring PyPI | All versions | 0.10.1 |
Products include Python Keyring.
How do I fix CVE-2012-5578?
Upgrade keyring to a fixed version for your release line: 0.10 or 0.10.1.
Is CVE-2012-5578 being exploited?
There is no known exploitation of CVE-2012-5578 in the wild and no public exploit code.
Other vulnerabilities in Python keyring
Sources
Also known as DEBIAN-CVE-2012-5578, GHSA-8867-vpm3-g98g, PYSEC-2019-182.