Bug 1224791 (CVE-2024-33901)

Summary:	VUL-0: CVE-2024-33901: keepassxc: recovery of passwords stored in the .kdbx database
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	RESOLVED WONTFIX	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	camila.matos
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/406771/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-05-21 11:08:02 UTC

Issue in KeePassXC 2.7.7 allows an attacker to recover some passwords stored in the .kdbx database.

References:
https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838
https://keepassxc.org/blog/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-33901
https://www.cve.org/CVERecord?id=CVE-2024-33901

Comment 2 Camila Camargo de Matos 2024-05-22 13:51:52 UTC

Closing this bug as RESOLVED/WONTFIX, as it is unlikely this issue will be fixed by upstream. There are hardening measures implemented to mitigate the problem, but solving it completely would require a solution involving more than changes to just keepassxc. See [0] for more information.

[0] https://github.com/keepassxreboot/keepassxc/issues/10784