Bug 2118613 (CVE-2022-26306) - CVE-2022-26306 libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
Summary: CVE-2022-26306 libreoffice: Static Initialization Vector Allows to Recover Pa...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-26306
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2118621 2118920 2118921 2118922 2118923 2134750 2134755 2134756
Blocks: 2112117
TreeView+ depends on / blocked
 
Reported: 2022-08-16 09:25 UTC by Sandipan Roy
Modified: 2023-01-25 10:22 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in LibreOffice, where the required initialization vector for encryption was always the same. Stored passwords are encrypted with a single master key provided by the user. This issue weakens the security of the encryption, making them vulnerable if an attacker has access to the user's configuration data.
Clone Of:
Environment:
Last Closed: 2023-01-25 10:22:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:0089 0 None None None 2023-01-12 09:14:52 UTC
Red Hat Product Errata RHSA-2023:0304 0 None None None 2023-01-23 15:17:30 UTC

Description Sandipan Roy 2022-08-16 09:25:20 UTC 
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306
Comment 1 Sandipan Roy 2022-08-16 09:33:09 UTC 
Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 2118621]
Comment 3 errata-xmlrpc 2023-01-12 09:14:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0089 https://access.redhat.com/errata/RHSA-2023:0089
Comment 4 errata-xmlrpc 2023-01-23 15:17:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0304 https://access.redhat.com/errata/RHSA-2023:0304
Comment 5 Product Security DevOps Team 2023-01-25 10:22:22 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-26306
Note You need to log in before you can comment on or make changes to this bug.