Source: keepassxc Version: 2.7.10+dfsg1-1 Severity: normal Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer and Security Team, I am reporting the public upstream advisory GHSA-rq29-wgrv-xgh4 for assessment in Debian: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-rq29-wgrv-xgh4 Upstream reports an integer overflow in the legacy KeePass 1 (.kdb) importer. A crafted record count can overflow a 32-bit multiplication in parseGroupTreeState(), bypassing the buffer-length check and causing out-of-bounds reads. The advisory lists versions before 2.8.0 as affected and 2.8.0 as patched. Upstream assesses the impact as denial of service requiring import of a crafted file and rates the issue Low. The patch performs the multiplication using a 64-bit integer. The release notes associate this fix with upstream PR #13682. The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026: https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/ I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have not independently reproduced this issue or verified whether Debian-specific patches address it. On 10 October 2026, I could not find a corresponding entry on the package's Security Tracker page or a matching report in the current source-package bug list. Could you assess whether Debian is affected and consider backporting the applicable fix to trixie? Please adjust the severity as appropriate. Thank you, Jonatan Nyberg
