2023-04-15 Audit Report - What happened with feedback?

[MS90D3V]

Hello,

I was looking up audits for KeepasXC and I found this article: https://keepassxc.org/blog/2023-04-15-audit-report/
It's mostly a positive report but one sentence stood out to me:

"The memory deallocation could be improved to not to contain secrets after the database is locked though."

Now I am not going to lie, I don't know what memory deallocation is, and why it contains secrets after database is locked, I am not familiar with this project. But I am wondering if any actions have been taken based on this information? I took a glance at the release notes but didn't see anything? Maybe it's not a big security risk? Anyone have information?

[droidmonkey]

See #7335 and #9087

[MS90D3V]

Thanks for pointing the way 👍

[MS90D3V]

For future readers of this discussion. I read:

• Database data is not cleared from RAM after lock #7335
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32784
• CVE-2023-32784 : is KeepassXC affected ? #9433 (comment)

If I understand it correctly, these hacks and memory dumps are possible if an hacker has admin privileges. So your machine needs to be compromised. And if that's the case, you have other issues to worry about. So it seems like a non-issue.

[phoerious]

Yes.