CVE-2022-26307: Weak Master Keys
First published: Mon Jul 25 2022(Updated: )
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.
Credit: security@documentfoundation.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| The Document Foundation LibreOffice | >=7.2.0<7.2.7 | |
| The Document Foundation LibreOffice | >=7.3.0<7.3.3 | |
| Debian Debian Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-26307?
CVE-2022-26307 is a vulnerability in LibreOffice that allows the weakening of the entropy of the master key used to encrypt stored passwords for web connections.
How does CVE-2022-26307 affect LibreOffice?
CVE-2022-26307 affects LibreOffice versions 7.2.0 to 7.2.7 and versions 7.3.0 to 7.3.3, as well as Debian Linux 10.0.
What is the severity of CVE-2022-26307?
CVE-2022-26307 has a severity rating of 8.8 (high).
How can I fix the CVE-2022-26307 vulnerability?
To fix the CVE-2022-26307 vulnerability, users should update their LibreOffice software to the latest version available.
Where can I find more information about CVE-2022-26307?
More information about CVE-2022-26307 can be found on the Openwall and Debian websites, as well as the LibreOffice security advisories page.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/libreoffice
- canonical/the document foundation libreoffice
- version/the document foundation libreoffice/7.2.0
- version/the document foundation libreoffice/7.3.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0