Bug 2118613 (CVE-2022-26306)

Summary:	CVE-2022-26306 libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, dtardon, erack, sbergman
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in LibreOffice, where the required initialization vector for encryption was always the same. Stored passwords are encrypted with a single master key provided by the user. This issue weakens the security of the encryption, making them vulnerable if an attacker has access to the user's configuration data.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-25 10:22:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2118621, 2118920, 2118921, 2118922, 2118923, 2134750, 2134755, 2134756
Bug Blocks:	2112117

Description Sandipan Roy 2022-08-16 09:25:20 UTC

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306

Comment 1 Sandipan Roy 2022-08-16 09:33:09 UTC

Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2118621]

Comment 3 errata-xmlrpc 2023-01-12 09:14:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089

Comment 4 errata-xmlrpc 2023-01-23 15:17:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304

Comment 5 Product Security DevOps Team 2023-01-25 10:22:22 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26306