Bug 827178 - python-keyring: CryptedFileKeyring uses AES/CFB insecurely
Summary: python-keyring: CryptedFileKeyring uses AES/CFB insecurely
Keywords:
Status: CLOSED DUPLICATE of bug 872260
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 827180
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-31 20:20 UTC by Vincent Danen
Modified: 2019-09-29 12:53 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-15 16:51:50 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2012-05-31 20:20:26 UTC 
It was found [1] that python-keyring's CryptedFileKeyring uses AES/CFB in an insecure manner.  CFB requires an unpredictable IV, but CryptedFileKeyring did not pass one, which meant that in python-crypto < 2.6, it was set to '\0' * 16 (entirely predictable value).  In python-crypto 2.6, it is mandatory to specify an IV.

On Fedora, when using python-crypto 2.6+, python-keyring will not work; with earlier versions it will continue to work, but use the predictable IV.

[1] https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845
Comment 1 Vincent Danen 2012-05-31 20:22:42 UTC 
Created python-keyring tracking bugs for this issue

Affects: fedora-all [bug 827180]
Comment 2 Vincent Danen 2013-02-15 16:51:50 UTC 

*** This bug has been marked as a duplicate of bug 872260 ***
Note You need to log in before you can comment on or make changes to this bug.