cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ericgeater
Community Champion

KeePass vuln revealed

Since we were just talking about password managers, this was a timely find.

 

KeePass Vulnerability Imperils Master Passwords (darkreading.com)

 

Keep your PC safe for a little while as the patch is written.

-----------
A claim is as good as its veracity.
1 Reply
denbesten
Community Champion

You beat me to it :-).  And echoing Eric's advise, "Lets be careful out there" [cite - Sgt. Esterhaus].

 

Mitigation is to upgrade to current (2.54), which was released today.

 

The relevant CVE does not yet have a score, but the brief description ("recover the cleartext master password from a memory dump") tells us it will have "attack vector: local" "Privileges required: low", "Confidentiality Impact: high". Based on this, if you are the slightest bit concerned of compromise, after upgrading to current, also change your master password, then sync everywhere so all copies of the old vault are overwritten.

 

And to protect against loss, make a "portable apps" copy of the application and your vault, write your master password on a slip of paper and place both into your physical safe or a safe deposit box. Then, once in a blue moon, take it out and re-sync it.  Remember, an old password list is better than no password list.