Skip to content

Incorrect Default Permissions in keyring

Moderate severity GitHub Reviewed Published Mar 10, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

pip keyring (pip)

Affected versions

< 0.10

Patched versions

0.10

Description

Python keyring has insecure permissions on new databases allowing world-readable files to be created

References

Reviewed Mar 10, 2020
Published to the GitHub Advisory Database Mar 10, 2020
Last updated Jan 9, 2023

Severity

Moderate
6.2
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CVE ID

CVE-2012-5578

GHSA ID

GHSA-8867-vpm3-g98g

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.