CVE-2024-5261: TLS certificate are not properly verified when utilizing LibreOfficeKit
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPTSSLVERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPTSSLVERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libreofficeto a version that resolves this vulnerability.Fixed in 4:7.6.7-0ubuntu0.23.10.3 - Upgrade
Upgrade
ubuntu/libreofficeto a version that resolves this vulnerability.Fixed in 4:24.2.4-0ubuntu0.24.04.2 - Upgrade
Upgrade
ubuntu/libreofficeto a version that resolves this vulnerability.Fixed in 4:24.2.4-1 - Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 1:7.0.4-4+deb11u9Fixed in 1:7.0.4-4+deb11u10Fixed in 4:7.4.7-1+deb12u3Fixed in 4:7.4.7-1+deb12u4Fixed in 4:24.2.5-1Fixed in 4:24.2.5-2 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Fixed in 24.2.4 - Configuration
In LibreOfficeKit mode, ensure curl TLS certificate verification is enabled by setting/operating with CURLOPT_SSL_VERIFYPEER=true (previously affected behavior was CURLOPT_SSL_VERIFYPEER=false).
LibreOfficeKit (curl usage) CURLOPT_SSL_VERIFYPEER = true
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5261?
CVE-2024-5261 has been classified as a high-severity vulnerability due to its potential impact on the confidentiality and integrity of data.
How do I fix CVE-2024-5261?
To address CVE-2024-5261, upgrade LibreOffice to a secure version, specifically to any of the remedied versions provided in the vendor advisory.
What systems are affected by CVE-2024-5261?
CVE-2024-5261 affects multiple LibreOffice versions on Ubuntu and Debian operating systems.
What is the nature of the vulnerability described in CVE-2024-5261?
CVE-2024-5261 is an improper certificate validation vulnerability that allows TLS certification verification to be disabled in LibreOfficeKit.
Are there workarounds for CVE-2024-5261?
No official workarounds are recommended for CVE-2024-5261; the best mitigation is to update to a patched version of LibreOffice.