{"id":"CVE-2012-4571","aliases":["DEBIAN-CVE-2012-4571","EUVD-2012-0012","GHSA-p3h7-3c45-qj4v","PYSEC-2012-8"],"status":"published","title":"Python Keyring does not securely initialize encryption cipher","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0037,"percentile":0.31134,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310","CWE-326"],"published":"2012-11-30T22:00:00Z","modified":"2026-10-23T17:47:39Z","fixes":[{"ecosystem":"PyPI","package":"keyring","fixed_in":["0.9.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-keyring","fixed_in":["0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-keyring","fixed_in":["0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-keyring","fixed_in":["0.9.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.1"},{"fixed":"0.9.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.5.1","0.6.2","0.7","0.7.1","0.8","0.8.1","0.9","0.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"versions":["0.1","0.2","0.3","0.4","0.5","0.5.1","0.6.2","0.7","0.7.1","0.8","0.8.1","0.9","0.9.1"]}],"products":[{"vendor":"python","product":"keyring"}],"references":[{"url":"http://pypi.python.org/pypi/keyring","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/10/31/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1634-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4571","tags":["advisory"]},{"url":"https://github.com/jaraco/keyring/commit/162f2ed0e39e16d561732b9fad8af6cd2341d7bd","tags":["web"]},{"url":"https://github.com/jaraco/keyring/commit/56272d908ba7a3fe4ebb6d6e87a7cc569f4726ac","tags":["web"]},{"url":"https://github.com/jaraco/keyring/commit/a76942672f6ac85a88bd9b9ed31fd133119b7702","tags":["web"]},{"url":"https://github.com/jaraco/keyring/commit/cbf509b0386c3063d8b2879ce72d78ac18023f72","tags":["web"]},{"url":"https://github.com/jaraco/keyring/commit/cc1ead78d1e3fab9fa8bb0b4bb334cb82d35db52","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2012-8.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p3h7-3c45-qj4v","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-4571","tags":["advisory"]},{"url":"https://github.com/jaraco/keyring","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-4571","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:00:00Z","modified":"2024-09-17T03:07:17.992Z","updated_at":"2026-11-02T14:34:51.937988Z"}],"euvd":[{"id":"EUVD-2012-0012","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:00:00Z","modified":"2024-09-17T03:07:17Z","updated_at":"2026-11-03T00:28:34.673232Z"}],"ghsa":[{"id":"GHSA-p3h7-3c45-qj4v","title":"Python Keyring does not securely initialize encryption cipher","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for `CryptedFileKeyring` files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2022-05-17T05:18:21Z","modified":"2024-09-27T17:28:12Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2012-4571","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:55:01.83Z","modified":"2026-06-16T23:45:25.253Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"GHSA-p3h7-3c45-qj4v","title":"Python Keyring does not securely initialize encryption cipher","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for `CryptedFileKeyring` files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2022-05-17T05:18:21Z","modified":"2024-09-27T17:35:00.52403Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P","level":"high"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"CVE-2012-4571","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:55:01Z","modified":"2026-04-10T03:42:30.581852Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2012-4571","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:55:01.83Z","modified":"2026-10-23T17:47:39.143179682Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"PYSEC-2012-8","description":"Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.","status":"published","published":"2012-11-30T22:55:00Z","modified":"2026-06-10T17:01:57.006905394Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}