Bug 2118610 (CVE-2022-26307)

Summary: CVE-2022-26307 libreoffice: Weak Master Keys
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caolanm, dtardon, erack, sbergman
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in LibreOffice, where the master key was poorly encoded, resulting in weakening its entropy from 128 to 43 bits. This issue makes the stored passwords that are encrypted with a single master key provided by the user vulnerable to a brute force attack if an attacker has access to the user’s stored config.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-01-25 09:22:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2118618, 2118924, 2118925, 2118926, 2118927, 2134751, 2134757, 2134758    
Bug Blocks: 2112117    

Description Sandipan Roy 2022-08-16 09:23:56 UTC 
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307
Comment 1 Sandipan Roy 2022-08-16 09:32:13 UTC 
Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2118618]
Comment 3 errata-xmlrpc 2023-01-12 09:14:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089
Comment 4 errata-xmlrpc 2023-01-23 15:17:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304
Comment 5 Product Security DevOps Team 2023-01-25 09:22:10 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26307