CVE-2012-4571: Python Keyring does not securely initialize encryption cipher
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.20662%
CWE
Published
5/17/2022
Updated
9/27/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keyring | pip | <= 0.9.1 | 0.9.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from how CryptedFileKeyring handled encryption:
- _init_crypter used the raw password (padded to 32 bytes) as the AES key without proper key derivation.
- AES.MODE_CFB was initialized with an implicit zero IV (no randomness).
- No salt was used in key generation, allowing rainbow table attacks.
- The commit 162f2ed replaced these with PBKDF2 for key derivation and random IVs, confirming the weakness in the original implementation. The encrypt/decrypt methods directly utilized this flawed initialization, making them vulnerable entry points.