It was reported [1] that python-keyring prior to version 0.9.1 used the user-supplied password insecurely. This was fixed in 0.9.1 [2] as noted by the following changelog entry: CryptedFileKeyring now uses PBKDF2 to derive the key from the user's password and a random hash. The IV is chosen randomly as well. All the stored passwords are encrypted at once. Any keyrings using the old format will be automatically converted to the new format (but will no longer be compatible with 0.9 and earlier). The user's password is no longer limited to 32 characters. PyCrypto 2.5 or greater is now required for this keyring. I'm unsure if we can update everything to this due to the requirement of python-crypto 2.5 (Red Hat Enterprise Linux 6 comes with 2.0.1, which will likely make it difficult to upgrade EPEL6 to this version or probably use the code as-is; the issue is that PyCrypto 2.5 procides PBKDF2 which is what this implementation is using). Fedora 17 comes with 2.6, so it would be easy to update to this latest version there. A patch [3] is available. [1] https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845 [2] http://pypi.python.org/pypi/keyring#id2 [3] https://bitbucket.org/kang/python-keyring-lib/changeset/576e21ab1e6dba1cfb13a1112841798679c21057
While this does affect EPEL6, I'm not going to file a tracking bug as I don't believe it can be fixed unless/until Red Hat Enterprise Linux 6 provides PyCrypto 2.5. I am far from a crypto expert so I don't know if there is a way to replace the use of PBKDF2 with something else (FWIW, PBKDF1 is also only provided in 2.5, and I don't know if any other reasonable key derivation functions exist in earlier versions). This should be fixed in Fedora, however.
Created python-keyring tracking bugs for this issue Affects: fedora-all [bug 872262]
*** Bug 827178 has been marked as a duplicate of this bug. ***
python-keyring-3.3-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-keyring-3.3-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Statement: Red Hat Product Security has rated this issue as having Low security impact in Red Hat OpenStack Platform 4.0. This issue is not currently planned to be addressed in future updates.