CVE-2012-5578

Insecure permissions in Python keyring

• CVSS 6.2
• CWE-276: Incorrect Default Permissions
• Design Defects
• Local

Python keyring has insecure permissions on new databases allowing world-readable files to be created

CVE

CVE-2012-5578

CWE

CWE-276: Incorrect Default Permissions

CVSS base score

6.2

Published

2019-11-25

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Assignment

Code defect classification

Incorrect Assignment

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Local

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Ensure that the permissions on Python keyring databases are set correctly to prevent world-readable files. Update Python keyring to the latest secure version.

from lxml import etree

def parse_xml(xml_data):
    parser = etree.XMLParser()
    tree = etree.fromstring(xml_data, parser)
    print(tree.tag)

xml_data = """
<!DOCTYPE root [
<!ENTITY read SYSTEM "file:///etc/passwd">
]>
<root>&read;</root>
"""

parse_xml(xml_data)

from lxml import etree

def parse_xml(xml_data):
    parser = etree.XMLParser(no_network=True, resolve_entities=False)
    tree = etree.fromstring(xml_data, parser)
    print(tree.tag)

xml_data = """
<!DOCTYPE root [
<!ENTITY read SYSTEM "file:///etc/passwd">
]>
<root>&read;</root>
"""

parse_xml(xml_data)

@misc{vaitp:cve20125578,
  title        = {{Insecure permissions in Python keyring}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-5578},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-5578/}}
}