Source: keepassxc Version: 2.7.10+dfsg1-1 Severity: important Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer and Security Team, I am reporting the public upstream advisory GHSA-3448-gh8j-3227 for assessment in Debian: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227 Upstream reports an out-of-bounds write when encrypting oversized browser-integration responses. A client with a valid database association can trigger the problem when an unlocked database produces a sufficiently large authorized response. The advisory lists versions 2.3.0 through 2.7.12 as affected and 2.8.0 as patched. The upstream reproducer demonstrated a process crash on Windows; it does not establish code execution or credential disclosure, and I have not tested the impact on Debian. The affected code is in the cross-platform desktop application's browser integration. The release notes associate this fix with upstream PR #13679. The decrypt-path changes are described in the advisory as defense in depth rather than a separately confirmed reachable vulnerability. The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026: https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/ I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have not independently reproduced this issue or verified whether Debian-specific patches address it. On 10 October 2026, I could not find a corresponding entry on the package's Security Tracker page or a matching report in the current source-package bug list. Could you assess whether Debian is affected and consider backporting the applicable fix to trixie? Please adjust the severity as appropriate. Thank you, Jonatan Nyberg
