CVE-2012-5577 : Python keyring lib before 0.10 created keyring files with world-readable permiss

Python keyring lib before 0.10 created keyring files with world-readable permissions.

Published 2019-10-28 17:15:20

Updated 2019-10-31 20:11:38

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2012-5577

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Python » Keyring
Versions before (<) 0.10
cpe:2.3:a:python:keyring:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Assigned by: nvd@nist.gov (Primary)

https://bitbucket.org/kang/python-keyring-lib/issue/67/set-go-rwx-on-keyring_passcfg

Log in with Atlassian account
Permissions Required
http://www.openwall.com/lists/oss-security/2012/11/27/3

oss-security - Re: CVE Request: Python keyring
Mailing List;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5577

881132 – (CVE-2012-5577, CVE-2012-5578) CVE-2012-5577 CVE-2012-5578 python-keyring: insecure permissions on configuration file
Issue Tracking;Third Party Advisory
https://bitbucket.org/kang/python-keyring-lib/commits/049cd181470f1ee6c540e1d64acf1def7b1de0c1

kang / Python Keyring Lib / commit / 049cd181470f — Bitbucket
Patch;Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5577

CVE-2012-5577
Third Party Advisory

Jump to