CVE-2022-26306

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-26306", "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "assignerShortName": "Document Fdn.", "dateUpdated": "2024-08-03T05:03:31.153Z", "dateReserved": "2022-02-28T00:00:00.000Z", "datePublished": "2022-07-25T00:00:00.000Z"}, "containers": {"cna": {"title": "Execution of Untrusted Macros Due to Improper Certificate Validation", "providerMetadata": {"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2", "shortName": "Document Fdn.", "dateUpdated": "2023-03-26T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "LibreOffice supports the storage of passwords for web connections in the user\u2019s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1."}], "affected": [{"vendor": "The Document Foundation", "product": "LibreOffice", "versions": [{"version": "7.2", "status": "affected", "lessThan": "7.2.7", "versionType": "custom"}, {"version": "7.3", "status": "affected", "lessThan": "7.3.1", "versionType": "custom"}]}], "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306"}, {"name": "[oss-security] 20220812 CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/08/13/1"}, {"name": "[debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"}], "credits": [{"lang": "en", "value": "OpenSource Security GmbH on behalf of the German Federal Office for Information Security"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-326 Inadequate Encryption Strength", "cweId": "CWE-326"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:03:31.153Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306", "tags": ["x_transferred"]}, {"name": "[oss-security] 20220812 CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/08/13/1"}, {"name": "[debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"}]}]}}

{}

{"affected": [{"affectedData": [{"product": "LibreOffice", "vendor": "The Document Foundation", "versions": [{"lessThan": "7.2.7", "status": "affected", "version": "7.2", "versionType": "custom"}, {"lessThan": "7.3.1", "status": "affected", "version": "7.3", "versionType": "custom"}]}], "source": "security@documentfoundation.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*", "matchCriteriaId": "20BCBB73-64D6-44F0-8B7F-F94269E9EEDA", "versionEndExcluding": "7.2.7", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1452E9B-C09C-4BF4-AE1F-C3AF6698BC33", "versionEndExcluding": "7.3.3", "versionStartIncluding": "7.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LibreOffice supports the storage of passwords for web connections in the user\u2019s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1."}, {"lang": "es", "value": "LibreOffice admite el almacenamiento de contrase\u00f1as para las conexiones web en la base de datos de configuraci\u00f3n del usuario. Las contrase\u00f1as almacenadas se cifran con una \u00fanica clave maestra proporcionada por el usuario. Se presentaba un fallo en LibreOffice en el que el vector de inicializaci\u00f3n requerido para el cifrado era siempre el mismo, lo que debilitaba la seguridad del cifrado haci\u00e9ndolo vulnerable si un atacante ten\u00eda acceso a los datos de configuraci\u00f3n del usuario. Este problema afecta a: The Document Foundation LibreOffice versiones 7.2 anteriores a 7.2.7; versiones 7.3 anteriores a 7.3.1"}], "id": "CVE-2022-26306", "lastModified": "2026-06-17T04:34:57.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-25T15:15:09.353", "references": [{"source": "security@documentfoundation.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/08/13/1"}, {"source": "security@documentfoundation.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"}, {"source": "security@documentfoundation.org", "tags": ["Vendor Advisory"], "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/08/13/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306"}], "sourceIdentifier": "security@documentfoundation.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "security@documentfoundation.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-330"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:0089", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "libreoffice-1:6.4.7.2-12.el8_7", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-01-12T00:00:00Z"}, {"advisory": "RHSA-2023:0304", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "libreoffice-1:7.1.8.1-8.el9_1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-01-23T00:00:00Z"}], "bugzilla": {"description": "libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password", "id": "2118613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2118613"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "details": ["LibreOffice supports the storage of passwords for web connections in the user\u2019s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.", "A flaw was found in LibreOffice, where the required initialization vector for encryption was always the same. Stored passwords are encrypted with a single master key provided by the user. This issue weakens the security of the encryption, making them vulnerable if an attacker has access to the user's configuration data."], "name": "CVE-2022-26306", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libreoffice", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "libreoffice:flatpak/libreoffice", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libreoffice:flatpak/libreoffice", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-26306\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-26306"], "threat_severity": "Moderate"}

{}