CVE-2023-32784

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

Allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. Disputed by vendor due to level of access required. (CVE-2023-24055) Possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running (CVE-2023-32784)

This update for keepass fixes the following issues:

Update to 2.54

• Security:

  • Improved process memory protection of secure edit controls (CVE-2023-32784, boo#1211397).

• New Features:

  • Triggers, global URL overrides, password generator profiles and a few more settings are now stored in the enforced configuration file.
  • Added dialog 'Enforce Options (All Users)' (menu 'Tools' → 'Advanced Tools' → 'Enforce Options'), which facilitates storing certain options in the enforced configuration file.
  • In report dialogs, passwords (and other sensitive data) are now hidden using asterisks by default (if hiding is activated in the main window); the hiding can be toggled using the new '***' button in the toolbar.
  • The 'Print' command in most report dialogs now requires the 'Print' application policy flag, and the master key must be entered if the 'Print - No Key Repeat' application policy flag is deactivated.
  • The 'Export' command in most report dialogs now requires the 'Export' application policy flag, and the master key must be entered.
  • Single line edit dialogs now support hiding the value using asterisks.
  • Commands that require elevation now have a shield icon like on Windows.
  • TrlUtil: added 'Move Selected Unused Text to Dialog Control' command.

• Improvements:

  • The content mode of the configuration elements '/Configuration/Application/TriggerSystem', '/Configuration/Integration/UrlSchemeOverrides' and '/Configuration/PasswordGenerator/UserProfiles' is now 'Replace' by default.
  • The built-in override for the 'ssh' URI scheme is now deactivated by default (it can be activated in the 'URL Overrides' dialog).
  • When opening the password generator dialog without a derived profile, the '(Automatically generated passwords for new entries)' profile is now selected by default, if profiles are enabled (otherwise the default profile is used).
  • The clipboard workarounds are now disabled by default (they are not needed anymore on most systems).
  • Improved clipboard clearing.
  • Improved starting of an elevated process.

• Bugfixes:

  • In report dialogs, the 'Print' and 'Export' commands now always use the actual data (in previous versions, asterisks were printed/exported when the application policy flag 'Unhide Passwords' was turned off).

• Update to 2.53.1

  • When testing a KDF ('Test' button in the database settings dialog), KeePass now spawns a child process that performs the KDF computation (which allows to cancel the test more cleanly in the case of excessive parameters; security is unaffected, because dummy data is used for the test).
  • Removed the 'Export - No Key Repeat' application policy flag; KeePass now always asks for the current master key when trying to export data.
  • Minor other improvements.

• Update to 2.53

  • New Features:

    • For each entry listed on the 'History' tab page of the entry dialog, the fields modified with respect to the previous entry are displayed.
    • Added 'Compare' button on the 'History' tab page of the entry dialog; when two (not necessarily consecutive) history entries are selected, clicking the button shows a detailed comparison (with values, etc.).
    • When editing an entry, the history entry list of the entry dialog now contains an entry called 'Dialog (unsaved)', which represents all data entered in the current dialog (other tab pages).
    • When editing an entry, the history entry list of the entry dialog now contains an entry called 'Current (TIME)', which is the entry that is currently stored in the database (without any changes made in the current dialog).
    • Added 'History' command in the 'Find' main menu; it lists all entry modifications (sorted by time).
    • Added filter box in most report dialogs (last modified entries, history, large entries, similar password clusters, password quality, history entry comparison, database file search, ...).
    • Added 'Print' button in most…

This update for keepass fixes the following issues:

• Update to 2.54

  • Security:

    • Improved process memory protection of secure edit controls (CVE-2023-32784, boo#1211397).

  • New Features:

    • Triggers, global URL overrides, password generator profiles and a few more settings are now stored in the enforced configuration file.
    • Added dialog 'Enforce Options (All Users)' (menu 'Tools' → 'Advanced Tools' → 'Enforce Options'), which facilitates storing certain options in the enforced configuration file.
    • In report dialogs, passwords (and other sensitive data) are now hidden using asterisks by default (if hiding is activated in the main window); the hiding can be toggled using the new '***' button in the toolbar.
    • The 'Print' command in most report dialogs now requires the 'Print' application policy flag, and the master key must be entered if the 'Print - No Key Repeat' application policy flag is deactivated.
    • The 'Export' command in most report dialogs now requires the 'Export' application policy flag, and the master key must be entered.
    • Single line edit dialogs now support hiding the value using asterisks.
    • Commands that require elevation now have a shield icon like on Windows.
    • TrlUtil: added 'Move Selected Unused Text to Dialog Control' command.

  • Improvements:

    • The content mode of the configuration elements '/Configuration/Application/TriggerSystem', '/Configuration/Integration/UrlSchemeOverrides' and '/Configuration/PasswordGenerator/UserProfiles' is now 'Replace' by default.
    • The built-in override for the 'ssh' URI scheme is now deactivated by default (it can be activated in the 'URL Overrides' dialog).
    • When opening the password generator dialog without a derived profile, the '(Automatically generated passwords for new entries)' profile is now selected by default, if profiles are enabled (otherwise the default profile is used).
    • The clipboard workarounds are now disabled by default (they are not needed anymore on most systems).
    • Improved clipboard clearing.
    • Improved starting of an elevated process.

  • Bugfixes:

    • In report dialogs, the 'Print' and 'Export' commands now always use the actual data (in previous versions, asterisks were printed/exported when the application policy flag 'Unhide Passwords' was turned off).

These are all security issues fixed in the keepass-2.54-1.1 package on the GA media of openSUSE Tumbleweed.