CVE-2022-26305 — Improper Certificate Validation in Document Foundation Libreoffice

CWE-295 — Improper Certificate Validation9 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.7%
top 27.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
THE Document Foundation LibreofficeLibreoffice
Timeline
PublishedJul 25
Latest updateOct 20

Description

An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5the_document_foundation/libreoffice7.2 — 7.2.7+1
▶NVDlibreoffice/libreoffice7.2.0 — 7.2.7+1
▶Debianlibreoffice/libreoffice< 1:7.0.4-4+deb11u2+3
▶Ubuntulibreoffice/libreoffice< 1:6.4.7-0ubuntu0.20.04.5

🔴Vulnerability Details

4
OSV
libreoffice vulnerabilities↗2022-10-06
▶
GHSA
GHSA-fm9c-xcj2-2j5g: An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only m↗2022-07-26
▶
CVEList
Execution of Untrusted Macros Due to Improper Certificate Validation↗2022-07-25
▶
OSV
CVE-2022-26305: An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only m↗2022-07-25
▶

📋Vendor Advisories

4
Ubuntu
LibreOffice vulnerabilities↗2022-10-20
▶
Ubuntu
LibreOffice vulnerabilities↗2022-10-06
▶
Red Hat
libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation↗2022-07-25
▶
Debian
CVE-2022-26305: libreoffice - An Improper Certificate Validation vulnerability in LibreOffice existed where de...↗2022
▶
CVE-2022-26305 — Improper Certificate Validation | cvebase