126 lines
5.1 KiB
JSON
126 lines
5.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"state": "PUBLISHED",
|
||
"cveId": "CVE-2022-26307",
|
||
"assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
|
||
"assignerShortName": "Document Fdn.",
|
||
"dateUpdated": "2024-08-03T05:03:31.842Z",
|
||
"dateReserved": "2022-02-28T00:00:00.000Z",
|
||
"datePublished": "2022-07-25T00:00:00.000Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Weak Master Keys",
|
||
"providerMetadata": {
|
||
"orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
|
||
"shortName": "Document Fdn.",
|
||
"dateUpdated": "2023-03-26T00:00:00.000Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3."
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "The Document Foundation",
|
||
"product": "LibreOffice",
|
||
"versions": [
|
||
{
|
||
"version": "7.2",
|
||
"status": "affected",
|
||
"lessThan": "7.2.7",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"version": "7.3",
|
||
"status": "affected",
|
||
"lessThan": "7.3.3",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307"
|
||
},
|
||
{
|
||
"name": "[oss-security] 20220812 CVE-2022-37401: Apache OpenOffice Weak Master Keys",
|
||
"tags": [
|
||
"mailing-list"
|
||
],
|
||
"url": "http://www.openwall.com/lists/oss-security/2022/08/13/2"
|
||
},
|
||
{
|
||
"name": "[debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update",
|
||
"tags": [
|
||
"mailing-list"
|
||
],
|
||
"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "OpenSource Security GmbH on behalf of the German Federal Office for Information Security"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"lang": "en",
|
||
"description": "CWE-326 Inadequate Encryption Strength",
|
||
"cweId": "CWE-326"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-03T05:03:31.842Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"name": "[oss-security] 20220812 CVE-2022-37401: Apache OpenOffice Weak Master Keys",
|
||
"tags": [
|
||
"mailing-list",
|
||
"x_transferred"
|
||
],
|
||
"url": "http://www.openwall.com/lists/oss-security/2022/08/13/2"
|
||
},
|
||
{
|
||
"name": "[debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update",
|
||
"tags": [
|
||
"mailing-list",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |