Bug 872260 (CVE-2012-4571)

Summary:	CVE-2012-4571 python-keyring: weak encryption in keyring
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gmollett, jrusnack, p, rtnpro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-keyring 0.9.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-03 07:00:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	872262
Bug Blocks:	1037470

Description Vincent Danen 2012-11-01 16:26:26 UTC

It was reported [1] that python-keyring prior to version 0.9.1 used the user-supplied password insecurely.  This was fixed in 0.9.1 [2] as noted by the following changelog entry:

CryptedFileKeyring now uses PBKDF2 to derive the key from the user's password and a random hash. The IV is chosen randomly as well. All the stored passwords are encrypted at once. Any keyrings using the old format will be automatically converted to the new format (but will no longer be compatible with 0.9 and earlier). The user's password is no longer limited to 32 characters. PyCrypto 2.5 or greater is now required for this keyring.

I'm unsure if we can update everything to this due to the requirement of python-crypto 2.5 (Red Hat Enterprise Linux 6 comes with 2.0.1, which will likely make it difficult to upgrade EPEL6 to this version or probably use the code as-is; the issue is that PyCrypto 2.5 procides PBKDF2 which is what this implementation is using).  Fedora 17 comes with 2.6, so it would be easy to update to this latest version there.

A patch [3] is available.

[1] https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845
[2] http://pypi.python.org/pypi/keyring#id2
[3] https://bitbucket.org/kang/python-keyring-lib/changeset/576e21ab1e6dba1cfb13a1112841798679c21057

Comment 1 Vincent Danen 2012-11-01 16:29:05 UTC

While this does affect EPEL6, I'm not going to file a tracking bug as I don't believe it can be fixed unless/until Red Hat Enterprise Linux 6 provides PyCrypto 2.5.  I am far from a crypto expert so I don't know if there is a way to replace the use of PBKDF2 with something else (FWIW, PBKDF1 is also only provided in 2.5, and I don't know if any other reasonable key derivation functions exist in earlier versions).

This should be fixed in Fedora, however.

Comment 2 Vincent Danen 2012-11-01 16:29:42 UTC

Created python-keyring tracking bugs for this issue

Affects: fedora-all [bug 872262]

Comment 3 Vincent Danen 2013-02-15 16:51:50 UTC

*** Bug 827178 has been marked as a duplicate of this bug. ***

Comment 4 Fedora Update System 2013-12-04 06:59:46 UTC

python-keyring-3.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2013-12-14 03:35:24 UTC

python-keyring-3.3-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Garth Mollett 2014-10-03 07:00:44 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact in Red Hat OpenStack Platform 4.0. This issue is not currently planned to be addressed in future updates.