Bug 2118613 (CVE-2022-26306)

Summary: CVE-2022-26306 libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caolanm, dtardon, erack, sbergman
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in LibreOffice, where the required initialization vector for encryption was always the same. Stored passwords are encrypted with a single master key provided by the user. This issue weakens the security of the encryption, making them vulnerable if an attacker has access to the user's configuration data.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-01-25 10:22:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2118920, 2118923, 2118621, 2118921, 2118922, 2134750, 2134755, 2134756    
Bug Blocks: 2112117    

Description Sandipan Roy 2022-08-16 09:25:20 UTC 
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306
Comment 1 Sandipan Roy 2022-08-16 09:33:09 UTC 
Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2118621]
Comment 3 errata-xmlrpc 2023-01-12 09:14:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089
Comment 4 errata-xmlrpc 2023-01-23 15:17:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304
Comment 5 Product Security DevOps Team 2023-01-25 10:22:22 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26306