Security update for keepass SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0163-1 Final 1 1 2023-06-30T07:32:26Z current 2023-06-30T07:32:26Z 2023-06-30T07:32:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for keepass This update for keepass fixes the following issues: - Update to 2.54 * Security: + Improved process memory protection of secure edit controls (CVE-2023-32784, boo#1211397). * New Features: + Triggers, global URL overrides, password generator profiles and a few more settings are now stored in the enforced configuration file. + Added dialog 'Enforce Options (All Users)' (menu 'Tools' → 'Advanced Tools' → 'Enforce Options'), which facilitates storing certain options in the enforced configuration file. + In report dialogs, passwords (and other sensitive data) are now hidden using asterisks by default (if hiding is activated in the main window); the hiding can be toggled using the new '***' button in the toolbar. + The 'Print' command in most report dialogs now requires the 'Print' application policy flag, and the master key must be entered if the 'Print - No Key Repeat' application policy flag is deactivated. + The 'Export' command in most report dialogs now requires the 'Export' application policy flag, and the master key must be entered. + Single line edit dialogs now support hiding the value using asterisks. + Commands that require elevation now have a shield icon like on Windows. + TrlUtil: added 'Move Selected Unused Text to Dialog Control' command. * Improvements: * The content mode of the configuration elements '/Configuration/Application/TriggerSystem', '/Configuration/Integration/UrlSchemeOverrides' and '/Configuration/PasswordGenerator/UserProfiles' is now 'Replace' by default. * The built-in override for the 'ssh' URI scheme is now deactivated by default (it can be activated in the 'URL Overrides' dialog). * When opening the password generator dialog without a derived profile, the '(Automatically generated passwords for new entries)' profile is now selected by default, if profiles are enabled (otherwise the default profile is used). * The clipboard workarounds are now disabled by default (they are not needed anymore on most systems). * Improved clipboard clearing. * Improved starting of an elevated process. * Bugfixes: + In report dialogs, the 'Print' and 'Export' commands now always use the actual data (in previous versions, asterisks were printed/exported when the application policy flag 'Unhide Passwords' was turned off). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-163 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CFQRNEAN42U36FDY44HBZDRFMS7QLMMZ/ E-Mail link for openSUSE-SU-2023:0163-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211397 SUSE Bug 1211397 https://www.suse.com/security/cve/CVE-2023-32784/ SUSE CVE CVE-2023-32784 page SUSE Package Hub 15 SP5 openSUSE Leap 15.5 keepass-2.54-bp155.2.3.1 keepass-2.54-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 keepass-2.54-bp155.2.3.1 as a component of openSUSE Leap 15.5 In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation. CVE-2023-32784 SUSE Package Hub 15 SP5:keepass-2.54-bp155.2.3.1 openSUSE Leap 15.5:keepass-2.54-bp155.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CFQRNEAN42U36FDY44HBZDRFMS7QLMMZ/ https://www.suse.com/security/cve/CVE-2023-32784.html CVE-2023-32784 https://bugzilla.suse.com/1211397 SUSE Bug 1211397