CVE-2022-26306: Execution of Untrusted Macros Due to Improper Certificate Validation
First published: Mon Jul 25 2022(Updated: )
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Credit: security@documentfoundation.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| The Document Foundation LibreOffice | >=7.2.0<7.2.7 | |
| The Document Foundation LibreOffice | >=7.3.0<7.3.3 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-26306?
CVE-2022-26306 is a vulnerability in LibreOffice where passwords for web connections are stored in the user's configuration database with a flawed encryption initialization vector.
How does CVE-2022-26306 affect LibreOffice?
CVE-2022-26306 affects LibreOffice versions 7.2.0 to 7.2.7 and versions 7.3.0 to 7.3.3, as well as Debian Linux 10.0, by allowing an attacker to exploit the flawed encryption initialization vector and potentially retrieve stored passwords for web connections.
What is the severity of CVE-2022-26306?
CVE-2022-26306 has a severity rating of 7.5 (high).
How can I mitigate CVE-2022-26306 in LibreOffice?
To mitigate CVE-2022-26306 in LibreOffice, it is recommended to update to a version higher than 7.3.3 or apply the necessary security patches provided by LibreOffice.
Where can I find more information about CVE-2022-26306?
You can find more information about CVE-2022-26306 at the following references: [link1], [link2], [link3].
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/libreoffice
- canonical/the document foundation libreoffice
- version/the document foundation libreoffice/7.2.0
- version/the document foundation libreoffice/7.3.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0