KeePass v2.54 fixes bug that leaked cleartext master password

KeePass has released version 2.54, fixing the CVE-2023-32784 vulnerability that allows the extraction of the cleartext master password from the application's memory.

When creating a new KeePass password manager database, users must create a master password, which is used to encrypt the database. When opening the database in the future, users are required to enter this master key to decrypt it and access the credentials stored within it.

However, in May 2023, security researcher 'vdohney' disclosed a vulnerability and proof-of-concept exploit that allowed you to partially extract the cleartext KeepPass master password from a memory dump of the application.

"The problem is with SecureTextBoxEx. Because of the way it processes input, when the user types the password, there will be leftover strings," explained vdohney in a KeePass bug report.

"For example, when "Password" is typed, it will result in these leftover strings: •a, ••s, •••s, ••••w, •••••o, ••••••r, •••••••d."

This dumper allows users to recover almost all master password characters apart from the first one or two, even if the KeePass workspace is locked or the program was closed recently.

Information-stealing malware or threat actors could use this technique to dump the program's memory and send it and the KeePass database back to a remote server for offline retrieval of the cleartext password from the memory dump. Once the password is retrieved, they can open the KeePass password database and access all the saved account credentials.

KeePass's creator and main developer, Dominik Reichl, acknowledged the flaw and promised to release a fix soon, having already implemented an effective solution being tested in beta builds.

Over the weekend, Reichl released KeePass 2.54 sooner than expected, and all users of the 2.x branch are strongly recommended to upgrade to the new version.

Users of KeePass 1.x, Strongbox, or KeePassXC are not impacted by CVE-2023-32784 and, thus, do not need to migrate to a newer release.

To fix the vulnerability, KeePass is now using a Windows API to set or retrieve data from text boxes, preventing the creation of managed strings that can potentially be dumped from memory.

Reichl also introduced "dummy strings" with random characters into the memory of the KeePass process to make it harder to retrieve fragments of the password from memory and combine them into a valid master password.

KeePass 2.5.4 also introduces other security enhancements, such as moving 'Triggers,' 'Global URL overrides,' and 'Password generator profiles' into the enforced configuration file, which provides additional security from attacks that modify the KeePass configuration file.

If the triggers, overrides, and profiles aren't stored in the enforced config because they were created using a previous version, they will be disabled automatically in 2.54, and users will have to manually activate them from the 'Tools' settings menu.

Users who cannot upgrade to KeePass 2.54 are recommended to reset their master password, delete crash dumps, hibernation files, and swap files that might contain fragments of their master password, or perform a fresh OS install.

Keep in mind that the issue impacts only passwords typed in the program's input forms, so if the credentials are copied and pasted into the boxes, no data-leaking strings are created in memory.

Freemason Christians Are Deeply Incoherent, Says Former ‘Worshipful Master’

Since the 18th century, Freemasonry and the presence of Catholics in its ranks have been the subject of countless condemnations by Church authorities, including by a dozen different popes. 

In his famous 1884 encyclical Humanum Genus, which denounced the moral and philosophical relativism of Freemasonry, Pope Leo XIII accused it of “publicly and openly planning the destruction of the holy Church,” “with the set purpose of utterly despoiling the nations of Christendom, if it were possible, of the blessings obtained for us through Jesus Christ our Savior.”

However, the fact that the Church has always explicitly forbidden Catholics to join Masonic bodies — until 1983, on pain of excommunication — has not prevented many Catholics from joining, in good faith, lodges of all kinds with the aim of broadening their spiritual horizons, or simply their professional network, without seeing it as a contradiction to their faith. This is particularly true in Anglo-Saxon countries, where the various Masonic “obediences” are more deist in essence than in most European countries, where a more political Freemasonry has spread, exported in large part from France. 

Christophe Flipo, a former “worshipful freemason master” in France, explains this context in this interview with the Register. Flipo himself practiced the same sort of deist Freemasonry that prevails in English-speaking areas, drawing on a blend of several religions, and says it is possibly even more problematic because of the way that it fosters confusion in the minds of its members in search of meaning.

In 2011, Flipo and his wife converted to Catholicism during a visit to the famous sanctuary of Notre-Dame de Rocamadour in southern France. This event shook up and called into question many aspects of his life — starting with his 25-year commitment to Freemasonry, which he ended after three years of discernment, as recounted in his books La Meilleure Part (The Best Part) and L’adieu aux Frères (A Farewell to Brothers).

First of all, could you tell us a little about your 20-plus years’ experience in Freemasonry?

I used to be a worshipful master. The grand master is the head of an obedience, which numbers between 25,000 or 50,000 brothers. An obedience is a federation of associations called lodges, presided over by worshipful masters. In 20 years, I’ve gone through all the ranks, and I’ve been venerable master of the Grande Loge traditionnelle et symbolique Opéra  (GLTSO). 

In France specifically, there is a widespread atheist republican Masonry, which wants to “create a better world,” notably through what they describe as “freedom of conscience.” This type of Freemasonry is much more present in France and is somewhat widespread in Europe. It’s a political masonry that wants to change society, by tackling political issues such as education, instruction, euthanasia and so on. 

I personally practiced Anglo-Saxon type masonry, which is a deist type of Masonry originating in England and present throughout the world.

How is Anglo-Saxon Masonry different? 

Anglo-Saxon Masonry, the kind I’ve practiced and which we know in the U.S. and England, is a much more spiritual type of Masonry, which takes a deistic approach, recognizing a Great Architect of the Universe, acknowledging that there are things beyond us, and asking, after Leibniz, why there is something rather than nothing. It thus embodies a quest for meaning and truth, but one that disregards religion. We’re not Christians, Muslims or Buddhists; we’re simply looking for meaning in life. 

On the other hand, the Grand Orient de France, and the overwhelming majority of the Grande Loge de France, want to change society because they are atheists. When you’re an atheist, there’s no Hope; spirituality is reduced to creating a better world. 

The atheist part of European Masonry has been greatly developed by the Grand Orient de France. For example, when Poland was liberated from the communist yoke, many Poles were initiated. Some became masters and worshipful masters in a single day, performed all the rites and immediately set up lodges in Poland to get the country off the ground again, and to sort of “take over the market” altogether. The idea was to set up political currents of thought to create an alternative to communism. But they pulled out all the stops because they even recruited former communist generals who turned their backs on communism. All this was done under the aegis of the Grand Orient de France.

Anglo-Saxon Masonry, being spiritual by definition, takes time to research its candidates, not someone who simply wants to create a better world. We also swear an oath before the Great Architect of the Universe. 

Would you, therefore, say that it’s acceptable for a Catholic to be a Freemason, as long as it’s a deist obedience? It’s not uncommon in the U.S. to see Christians, practicing Catholics, display the title “Freemason” on their business cards ...

It took me three years after my return to Catholicism to discern and understand its incompatibility with Masonry. Because when you start, they make you swear on the Bible, talking about “the Great Architect of the Universe, who created the world.” This evokes the first sentence of the Creed, so a Christian can relate to it. 

It starts to be a problem in later grades, when you have one, five, 10, 15, 20, 25 years’ experience. Gradually, the rites of passage begin to trivialize divine light: It’s no longer that of Christ; it becomes that of the Druids, the Greeks, alchemy, sometimes even the Egyptian tradition. We start mixing things up. Parallels were even invented between the Twelve Labors of Hercules and the Twelve Tribes of Israel and other such nonsense.

The ritual I practiced is called the “Emulation” ritual, the most widely practiced in the U.S. After a while, you’re no longer appealing to the Great Architect of the Universe, but to a mythical god who is the concatenation of the Syriac god Baal, the Egyptian god Ra and the Jewish god Jehovah. Paganism is what you end up with. 

We rely on a set of traditions, of which the Gospels are a part, but in the same way as other texts and traditions. The archangel Gabriel can become Mercury or Hermes. There’s even a St. John Lodge, but it’s absolutely not Christian; it’s full of alchemical references. Alchemy is the exaltation of man through the “Great Work,” i.e., the transformation of lead into gold. The goal is the transformation of the person performing the transforming. It’s a quest for omnipotence — an omnipotence without God or religion. 

That’s the perverse thing, and it takes time to understand it, as, at first, we’re happy to be selected, because it flatters the ego. For me, the main problem is that you’re inconsistent when you’re a Christian and a Mason. And the second problem is that faith is going to be trivialized. 

While I don’t blame the Freemasons in the first place, I do blame Masonry in its end, in its popularization and relativism vis-à-vis all religions, where everything is equal, and where there is no longer any truth in the end. 

If you’re a Christian and believe in the truth of the Gospel, there’s no reason to be interested in mysterious Greek or Egyptian rites, or in alchemy, which runs totally counter to the Christian faith. This is what I set out to explain in my book L’adieu aux Frères.

So I say to my Christian Mason brothers: Be consistent, you Christians; reread the texts and come face-to-face with the faith of the Gospel and of Christ. Incidentally, the first sentence Jesus says in St. John’s Gospel, as he turns to his two disciples who are following him, is: “What are you looking for?” That’s the key. When you’re a Freemason, you have to ask yourself, “What are you looking for, Mason?” They’re on a quest. If you’re a Christian, you’ve found the light. So what are you looking for in the mystery religions of Egypt, in the resurrection of Osiris?

Have you come to the conclusion that Freemasonry is Satanic or Luciferian in essence, as some ex-Freemasons claim?

If we consider that evil leads away from Christ, yes, since Freemasonry leads away from Christ. On the other hand, I think that those who claim that Masonry has stolen rites from Luciferian sects, that children’s blood is drunk, etc., are really going too far. The devil is much more subtle than that. But it’s diabolical, in the sense of evil that divides, that distances from Christ.

Masonry was basically invented by two Protestant pastors, [John Theophilus] Desaguliers and [James] Anderson, with the aim of stopping the wars of religion by spreading tolerance. They wanted to set aside the institutional Church. It was very Protestant, to begin with. That’s why it’s so widespread in the U.S. and England. There’s the idea that you can understand the Bible on your own, without the help of the Church. But there’s never been any question of blaming the Gospel or looking for Satan.

What finally prompted you to leave this practice?

I can’t really talk about a specific “click,” because it took three years. But my wife and I were converted during a visit to the Rocamadour Shrine, as I recount in my book La Meilleure Part. When I converted, the rector of the shrine told me that my Masonic commitment was incompatible with the Christian faith and that I should resign.

But before that, my wife had already told me she had a problem with Masonry. I wanted to resign because it was my duty as a husband. 

Masonry means we spend a lot of time outside with our “brothers,” and we tend to let our marriage down. This causes a total breakdown in the spiritual relationship with your wife. That’s why I left, but my rereading of Freemasonry with my new Christian perspective gave me much deeper reasons. I reread the texts of 20 years of teachings from a completely different perspective.

In an interview with Dominican Friar Paul Adrien on his YouTube channel, you noted that deist Freemasonry was gradually disappearing in favor of atheist obediences. How do you explain this? 

Indeed, the political Masonry of the Grand Orient de France and a large part of the Grande Loge de France represent two-thirds of French Masons. In the rest of Europe, in countries such as Poland, and in Eastern Europe, it’s this type of Masonry that has developed. And it continues to do so because it is less spiritual, and we know that the world is suffering from a lack of spirituality.

But in the end, I’m not unhappy about that, because deist Masonry has totally misused Christ and the Christian message. Atheists dream of a better world, think that euthanasia is better, that wokism is great, that man is nothing compared to the planet, and try to pray to stones, pebbles and other things. I don’t share any of their ideas, but in the end they’re acting in good faith, not claiming to be followers of Christ. But you have to understand that their aim is clearly political. 

How influential do you think Freemasonry really is in French and European politics?

Their influence is real, but weaker than people imagine. If an obedience such as the Grande Loge de France launches a subject for reflection, for example life in prisons, asking whether there is an alternative to prison to limit delinquency in France, it will send it to all the national lodges, of which there are around 1,500, which will discuss it locally and send a synthesis to the Grande Loge, which in turn will produce a general synthesis of all the syntheses and submit it to the deputies. This is how Masonry, especially the Grande Loge de France and the Grand Orient de France, influenced politics, especially during the Second and Third Republics. 

But in lodges like the GLTSO, Anglo-American lodges like the ones I’ve known, such things seem crazy to them because their aim is, above all, spiritual development, so it’s totally different. 

Having said that, today I think that, in a country like France, political lodges have a limited influence insofar as almost 100% of MPs, whether Masons or not, are modernists, and are therefore committed to the same cause of the evolution of society in an atheistic approach. But since politics is above all a world of networks, Masonry favors this mechanism of influence. 

What about the Church? Several experts have asserted that Catholic clerics belong to Freemasonry, without actually saying so. Do you know any of them?

I don’t know any personally. But I do remember, for example, the case of Father Pascal Vesin in Annecy, who was removed from office for belonging to the Grand Orient de France in 2013. Yet he was considered a great priest; he had filled the churches, created many charities. 

The bishop of his diocese had to publish a communiqué to justify his decision, the fruit of two years of correspondence during which the bishop had asked him to be consistent with his vocation and leave Freemasonry. I think the priest sinned out of pride at the time because, if you love Christ, there’s no reason to persist in it. 

It’s partly thanks to him that I wrote L’Adieu aux Frères, because at the time I wrote to the bishop to support him, because I thought he had done things very well. After 15 minutes, I had written five or six pages. I realized that I had something to tell, and in the end, I published a whole book.

So it makes no sense at all for a priest to do that. Jesus said, “Let your ‘Yes’ mean ‘Yes’ and your ‘No’ mean ‘No.’ Anything more is from the evil one.” This excludes the strange, convoluted oaths to Freemasonry that plunge us into darkness. Let’s remember that, by definition, the Gospel is the Good News, the Light that we must go and proclaim to the world.

Mipi d-phy globalfoundries 22nm IP Listing