Non notée
CVE-2022-26307 LibreOffice supports the storage of passwords for web connections in the user’s configuration database
Description
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LibreOffice 7.3 | 7.3 → < 7.3.3 | 7.3.3 |
| LibreOffice 7.2 | 7.2 → < 7.2.7 | 7.2.7 |
Références
- www.libreoffice.org www.libreoffice.org
- [oss-security] 20220812 CVE-2022-37401: Apache OpenOffice Weak Master Keys www.openwall.com
- [debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de LibreOffice
Les 48 CVE de LibreOffice →
CVE-2026-76181
Heap buffer overflow in dBASE index import
5.4
Moyenne
CVE-2026-63270
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information…
6.7
Moyenne
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer
6.7
Moyenne
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document
6.7
Moyenne