Bug 872260 - (CVE-2012-4571) CVE-2012-4571 python-keyring: weak encryption in keyring
CVE-2012-4571 python-keyring: weak encryption in keyring
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20120526,reported=2...
: Security
: 827178 (view as bug list)
Depends On: 872262
Blocks: 1037470
  Show dependency treegraph
 
Reported: 2012-11-01 12:26 EDT by Vincent Danen
Modified: 2014-10-03 04:52 EDT (History)
4 users (show)

See Also:
Fixed In Version: python-keyring 0.9.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-03 03:00:44 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-11-01 12:26:26 EDT
It was reported [1] that python-keyring prior to version 0.9.1 used the user-supplied password insecurely.  This was fixed in 0.9.1 [2] as noted by the following changelog entry:

CryptedFileKeyring now uses PBKDF2 to derive the key from the user's password and a random hash. The IV is chosen randomly as well. All the stored passwords are encrypted at once. Any keyrings using the old format will be automatically converted to the new format (but will no longer be compatible with 0.9 and earlier). The user's password is no longer limited to 32 characters. PyCrypto 2.5 or greater is now required for this keyring.

I'm unsure if we can update everything to this due to the requirement of python-crypto 2.5 (Red Hat Enterprise Linux 6 comes with 2.0.1, which will likely make it difficult to upgrade EPEL6 to this version or probably use the code as-is; the issue is that PyCrypto 2.5 procides PBKDF2 which is what this implementation is using).  Fedora 17 comes with 2.6, so it would be easy to update to this latest version there.

A patch [3] is available.

[1] https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845
[2] http://pypi.python.org/pypi/keyring#id2
[3] https://bitbucket.org/kang/python-keyring-lib/changeset/576e21ab1e6dba1cfb13a1112841798679c21057
Comment 1 Vincent Danen 2012-11-01 12:29:05 EDT
While this does affect EPEL6, I'm not going to file a tracking bug as I don't believe it can be fixed unless/until Red Hat Enterprise Linux 6 provides PyCrypto 2.5.  I am far from a crypto expert so I don't know if there is a way to replace the use of PBKDF2 with something else (FWIW, PBKDF1 is also only provided in 2.5, and I don't know if any other reasonable key derivation functions exist in earlier versions).

This should be fixed in Fedora, however.
Comment 2 Vincent Danen 2012-11-01 12:29:42 EDT
Created python-keyring tracking bugs for this issue

Affects: fedora-all [bug 872262]
Comment 3 Vincent Danen 2013-02-15 11:51:50 EST
*** Bug 827178 has been marked as a duplicate of this bug. ***
Comment 4 Fedora Update System 2013-12-04 01:59:46 EST
python-keyring-3.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-12-13 22:35:24 EST
python-keyring-3.3-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Garth Mollett 2014-10-03 03:00:44 EDT
Statement:

Red Hat Product Security has rated this issue as having Low security impact in Red Hat OpenStack Platform 4.0. This issue is not currently planned to be addressed in future updates.

Note You need to log in before you can comment on or make changes to this bug.