CVE-2022-26306
Published: 25 July 2022
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libreoffice Launchpad, Ubuntu, Debian |
bionic |
Released
(1:6.0.7-0ubuntu0.18.04.12)
|
| focal |
Released
(1:6.4.7-0ubuntu0.20.04.5)
|
|
| jammy |
Not vulnerable
(1:7.3.3-0ubuntu0.22.04.1)
|
|
| kinetic |
Not vulnerable
|
|
| lunar |
Not vulnerable
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(1:7.3.3~rc1-2)
|
|
| xenial |
Ignored
(end of standard support)
|
|
|
Patches: upstream: https://github.com/LibreOffice/core/commit/ab77587ec300f5c30084471000663c46ddf25dad upstream: https://github.com/LibreOffice/core/commit/713296ecd30bab02d41fcd23f19afed28d916701 upstream: https://github.com/LibreOffice/core/commit/bfec3cf63ef43cc86e9a2fd90600d91b5fefe0c3 upstream: https://github.com/LibreOffice/core/commit/55d3095f14e98e5d2aadddf392911ca2d2b6dca9 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |