In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump,     even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap     file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first     character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for     mitigation. (CVE-2023-32784)

Note that Nessus relies on the presence of the package as reported by the vendor.

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0157-1 advisory.

  - In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump,     even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap     file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first     character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for     mitigation. (CVE-2023-32784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250516	Linux Distros Unpatched Vulnerability : CVE-2023-32784	Nessus	Misc.	high
181675	Keepass < 2.54 Information disclosure	Nessus	Windows	high
177701	openSUSE 15 Security Update : keepass (openSUSE-SU-2023:0157-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-32784

high

Tenable Plugins

high

high

high