CVE-2022-26306: Execution of Untrusted Macros Due to Improper Certificate Validation
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-26306?
CVE-2022-26306 is a vulnerability in LibreOffice where passwords for web connections are stored in the user's configuration database with a flawed encryption initialization vector.
How does CVE-2022-26306 affect LibreOffice?
CVE-2022-26306 affects LibreOffice versions 7.2.0 to 7.2.7 and versions 7.3.0 to 7.3.3, as well as Debian Linux 10.0, by allowing an attacker to exploit the flawed encryption initialization vector and potentially retrieve stored passwords for web connections.
What is the severity of CVE-2022-26306?
CVE-2022-26306 has a severity rating of 7.5 (high).
How can I mitigate CVE-2022-26306 in LibreOffice?
To mitigate CVE-2022-26306 in LibreOffice, it is recommended to update to a version higher than 7.3.3 or apply the necessary security patches provided by LibreOffice.
Where can I find more information about CVE-2022-26306?
You can find more information about CVE-2022-26306 at the following references: [link1], [link2], [link3].