CVE-2022-26306
Execution of Untrusted Macros Due to Improper Certificate Validation
- State
- Published
- Severity
- Not scored
- Published
- Jul 25, 2022
- Updated
- Aug 3, 2024
- Reserved
- Feb 28, 2022
Description
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Scores
The record has no CVSS score.
Weaknesses
- CWE-326 Inadequate Encryption Strength
Affected Products
| Product | Versions |
|---|---|
LibreOfficeThe Document Foundation |
|
References
- https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306
- [oss-security] 20220812 CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Passwordmailing-list
- [debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.