Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Dec 2015 22:24:47 -0500
From: Reinhard Tartler <>
Cc: Yves-Alexis Perez <>,,, 
	Reinhard Tartler <>,
Subject: Re: Re: CVE request for keepassx password database export

On Mon, Nov 30, 2015 at 5:04 PM,  <> wrote:
> Hash: SHA256
>> it seems that keepassx 0.4.3 export function are a bit buggy. Starting an
>> export (using File / Export to / KeepassX XML file) and cancelling it leads to
>> KeepassX saving a cleartext XML file in ~/.xml without any warning.
>> This was reported privately to the Debian security team today, but it was
>> actually reported publicly earlier in the Debian BTS. Unfortunately the
>> maintainer didn't acknowledge the bug or forwarded it upstream, apparently.
>> It's not a terrible bug per se because leaking a user password file on purpose
>> would still require a lot of social engineering skills, but it still look like
>> it should get a CVE (an user explicitly cancelling the export surely doesn't
>> expect its passwords to be there in a hidden file.
>>> canceling export operation creates cleartext copy of all of the user's
>>> KeePassX password database entries
>>> with Debian's default umask, the file is even world-readable in
>>> multiuser machines
> Use CVE-2015-8378.
should fix the issue.

Felix, I've imported the package from bzr to git and put it to
collab-maint. I have not checked whether this issue also affects the
2.0 branch. Maybe this issue would make a good case for a 0.4.4


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.