Bug 827178

Summary:	python-keyring: CryptedFileKeyring uses AES/CFB insecurely
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rtnpro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-15 16:51:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	827180
Bug Blocks:

Description Vincent Danen 2012-05-31 20:20:26 UTC

It was found [1] that python-keyring's CryptedFileKeyring uses AES/CFB in an insecure manner.  CFB requires an unpredictable IV, but CryptedFileKeyring did not pass one, which meant that in python-crypto < 2.6, it was set to '\0' * 16 (entirely predictable value).  In python-crypto 2.6, it is mandatory to specify an IV.

On Fedora, when using python-crypto 2.6+, python-keyring will not work; with earlier versions it will continue to work, but use the predictable IV.

[1] https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845

Comment 1 Vincent Danen 2012-05-31 20:22:42 UTC

Created python-keyring tracking bugs for this issue

Affects: fedora-all [bug 827180]

Comment 2 Vincent Danen 2013-02-15 16:51:50 UTC


*** This bug has been marked as a duplicate of bug 872260 ***