Bug 2118610 (CVE-2022-26307) - CVE-2022-26307 libreoffice: Weak Master Keys
Summary: CVE-2022-26307 libreoffice: Weak Master Keys
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-26307
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2118618 2118924 2118925 2118926 2118927 2134751 2134757 2134758
Blocks: 2112117
TreeView+ depends on / blocked
 
Reported: 2022-08-16 09:23 UTC by Sandipan Roy
Modified: 2023-01-25 09:22 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in LibreOffice, where the master key was poorly encoded, resulting in weakening its entropy from 128 to 43 bits. This issue makes the stored passwords that are encrypted with a single master key provided by the user vulnerable to a brute force attack if an attacker has access to the user’s stored config.
Clone Of:
Environment:
Last Closed: 2023-01-25 09:22:12 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:0089 0 None None None 2023-01-12 09:14:51 UTC
Red Hat Product Errata RHSA-2023:0304 0 None None None 2023-01-23 15:17:27 UTC

Description Sandipan Roy 2022-08-16 09:23:56 UTC 
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307
Comment 1 Sandipan Roy 2022-08-16 09:32:13 UTC 
Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2118618]
Comment 3 errata-xmlrpc 2023-01-12 09:14:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089
Comment 4 errata-xmlrpc 2023-01-23 15:17:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304
Comment 5 Product Security DevOps Team 2023-01-25 09:22:10 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26307
Note You need to log in before you can comment on or make changes to this bug.