prehistoric-systems/keepassxc
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc.git synced 2026-03-11 08:54:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Security: Prevent loading of openssl.cnf

Browse source 
Prevent loading openssl.cnf from the originating vcpkg folder tree to avoid DLL injections. This patch force sets the OPENSSL_CONF env var to an invalid directory. This prevents openssl from attempting to load a cnf file which can contain settings to load arbitrary DLL files into KeePassXC memory space.

Thank you to zdi-disclosures for reporting this finding!
This commit is contained in:
Jonathan White 2026-03-08 23:42:42 -04:00
parent 56521023b8
commit 3534d81ff2
No known key found for this signature in database
GPG key ID: 440FC65F2E0C6E01
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/main.cpp
View file

@ -53,6 +53,12 @@ int main(int argc, char** argv)
{
QT_REQUIRE_VERSION(argc, argv, QT_VERSION_STR)
#ifdef Q_OS_WIN
// Set OPENSSL_CONF to an invalid location to prevent DLL injection via openssl.cnf.
// vcpkg by default hard-codes this to its packages location, which may be user-writable.
qputenv("OPENSSL_CONF", "::");
#endif
QApplication::setAttribute(Qt::AA_EnableHighDpiScaling);
QGuiApplication::setAttribute(Qt::AA_UseHighDpiPixmaps);
#if QT_VERSION >= QT_VERSION_CHECK(5, 14, 0) && defined(Q_OS_WIN)