Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-32784: KeePass 2.x before 2.54 can expose master password in memory
CVE-2023-32784 · published 3 years ago
Summary
The Debian KeePass 2 package versions before 2.54 keep the master password in clear text in memory, so a dump of the program’s memory, the system swap file, hibernation file, or a full RAM capture can reveal it (except the first character). This allows anyone with access to those files to recover the password and open the password database. Upgrade to KeePass 2.54 or later and avoid creating memory dumps of systems that run KeePass.
What to do
- Update keepass keepass to version 2.54 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | keepass2 | All versions |
| Debian:13 | debian | keepass2 | All versions |
| Debian:14 | debian | keepass2 | All versions |
| – | keepass | keepass |
>= 2.00, < 2.54 cpe:2.3:a:keepass:keepass:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | keepass2 | All versions |
Original advisory text
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass proces...
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
References
- https://ubuntu.com/security/CVE-2023-32784 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-32784 Third Party Advisory
- https://github.com/keepassxreboot/keepassxc/discussions/9433 Issue Tracking
- https://github.com/vdohney/keepass-password-dumper Third Party Advisory
- https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-32784 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published15 May 2023
Updated24 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta