[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20151130220422.09CD46C0211@smtpvmsrv1.mitre.org>
Date: Mon, 30 Nov 2015 17:04:22 -0500 (EST)
From: cve-assign@...re.org
To: corsac@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, dev@...passx.org, siretart@...ware.de
Subject: Re: CVE request for keepassx password database export
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> it seems that keepassx 0.4.3 export function are a bit buggy. Starting an
> export (using File / Export to / KeepassX XML file) and cancelling it leads to
> KeepassX saving a cleartext XML file in ~/.xml without any warning.
>
> This was reported privately to the Debian security team today, but it was
> actually reported publicly earlier in the Debian BTS. Unfortunately the
> maintainer didn't acknowledge the bug or forwarded it upstream, apparently.
>
> It's not a terrible bug per se because leaking a user password file on purpose
> would still require a lot of social engineering skills, but it still look like
> it should get a CVE (an user explicitly cancelling the export surely doesn't
> expect its passwords to be there in a hidden file.
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=791858
>> canceling export operation creates cleartext copy of all of the user's
>> KeePassX password database entries
>> with Debian's default umask, the file is even world-readable in
>> multiuser machines
Use CVE-2015-8378.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWXMX0AAoJEL54rhJi8gl568AQAMPk+Vtell3O4tGMdvlKi2RE
BOXFZA9wA6TtVqFWtQ+Kbgsi70ix2Cwc+vVvZIunPyAWGXaQ5jb9XtZ0G0YQ/K8O
/SIsOIgaObO59DPI8JUWvb7Pfj5C3ltb80gIV5+G/3exeWeEp4F8Q9T9SglZhpga
Av351FYWgkHS28l2Kgh832nrAl3aRjMOGxhgw758oXaU7IeJzSAtRv79fDMBuziR
7yQ8M7uD/VO9ZJSt1BPzMluz+B5cPzUqSuhxVor4SvxIxhFQWmo4eAiy3d4CD2Qr
B2qp77ity537ZXto/L4fPomAoZZbB9nEJJCaudWvdlCVj859KKiUU6zW6T89HvB1
iBo3p0N+4WDTe2/btkfXh0OFizmC2XP1qSR5BqfgoRCBNTohSAf/Al67d8RoZpx+
sLAZwCWs8w8z0RZsHvkexPv7V9BTOn5enzDrEqvdBsO5CPWdIuY+CVo0WWuo53ag
ESufvOqo8awLO+XDuI+3GXcKYPFAKrrreBiIeHS3NgT/mkXQT8OkhqUnQk10j0Z0
TK5k9zoMhPEu2MOJDbvJdbtgEFe1He2ZdsjlAGrWd8V5fzCTA7Sf/tH5Hz6GiJft
ZppT3OTzmNokQ2QR4xE5M0RwAnxxnfu0hsGqvLblajX0eG/6YpoOybqy/WOemaok
mS14P6ybQKUxW+XbN9YK
=kZt7
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
