CVE-2012-4571
Python Keyring does not securely initialize encryption cipher
CVE-2012-4571 is a low vulnerability (CVSS 2.1) in Python Keyring, published November 30, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in keyring 0.9.2.
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
Exploit likelihood
What each source reports
NVD Score used
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
CVE-2012-4571- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
CVE-2012-4571- Updated
- 2026-11-02
EUVDEUVD-2012-0012 No score
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
EUVD-2012-0012- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3h7-3c45-qj4v
Python Keyring does not securely initialize encryption cipher
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
GHSA-p3h7-3c45-qj4v- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVGHSA-p3h7-3c45-qj4v
Python Keyring does not securely initialize encryption cipher
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
GHSA-p3h7-3c45-qj4v- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSV No score
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
CVE-2012-4571- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4571 No score
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
DEBIAN-CVE-2012-4571- Updated
- 2026-11-02
OSVPYSEC-2012-8 No score
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
- Record
PYSEC-2012-8- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keyringPyPI |
through 0.9.1 | 0.9.2 |
python-keyringDebian:12 |
before 0.9.2-1 | 0.9.2-1 |
python-keyringDebian:13 |
before 0.9.2-1 | 0.9.2-1 |
python-keyringDebian:14 |
before 0.9.2-1 | 0.9.2-1 |
keyringPyPI |
before 0.9.2, plus listed versions 0.10.20.30.40.5 Show 8 moreShow less0.5.10.6.20.70.7.10.80.8.10.90.9.1 |
0.9.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
pypi.python.org/pypi/keyring
bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845
openwall.com/lists/oss-security/2012/10/31/8
ubuntu.com/usn/USN-1634-1
nvd.nist.gov/vuln/detail/CVE-2012-4571
github.com/jaraco/keyring/commit/162f2ed0e39e16d561732b9fad8af6cd2341d7bd
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2012-4571