Lucene search

Document Fdn.CVE-2021-25636

HistoryFeb 24, 2022 - 3:15 p.m.

CVE-2021-25636

2022-02-2415:15:21

CWE-295

CWE-347

Document Fdn.

web.nvd.nist.gov

1824

cve-2021-25636

libreoffice

digital signatures

certificate validation

vulnerability

nvd

security issue

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both “X509Data” and “KeyValue” children of the “KeyInfo” tag, which when opened caused LibreOffice to verify using the “KeyValue” but to report verification with the unrelated “X509Data” value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Affected configurations

Nvd

Node

libreofficelibreofficeRange7.2.0–7.2.5

Node

fedoraprojectfedoraMatch34

VendorProductVersionCPE
libreofficelibreoffice*cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
fedoraprojectfedora34cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libreoffice	libreoffice	*	cpe:2.3:a:libreoffice:libreoffice::::::::
fedoraproject	fedora	34	cpe:2.3:o:fedoraproject:fedora:34:::::::*

CNA Affected

[
  {
    "vendor": "The Document Foundation",
    "product": "LibreOffice",
    "versions": [
      {
        "version": "7.2",
        "status": "affected",
        "lessThan": "7.2.5",
        "versionType": "custom"
      }
    ]
  }
]