CVE-2017-18021

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-01-05 · updated 2026-06-17
Weakness: CWE-338

Description

It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GUI.

Affected products

Qtpass: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: Qtpass 1.2.1. Check the vendor advisory for mitigations.

References

https://github.com/IJHack/QtPass/issues/338
https://github.com/IJHack/QtPass/releases/tag/v1.2.1
https://lists.zx2c4.com/pipermail/password-store/2018-January/003165.html
https://qtpass.org/
https://github.com/IJHack/QtPass/issues/338
https://github.com/IJHack/QtPass/releases/tag/v1.2.1
https://lists.zx2c4.com/pipermail/password-store/2018-January/003165.html
https://qtpass.org/

Get alerted when CVE-2017-18021 or the next vulnerability affects your stack