Lucene search

[email protected]CVE-2021-25636

HistoryFeb 24, 2022 - 3:15 p.m.

CVE-2021-25636

2022-02-2415:15:21

CWE-347

CWE-295

[email protected]

web.nvd.nist.gov

1757

cve-2021-25636

libreoffice

digital signatures

certificate validation

vulnerability

nvd

security issue

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

38.8%

JSON

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both “X509Data” and “KeyValue” children of the “KeyInfo” tag, which when opened caused LibreOffice to verify using the “KeyValue” but to report verification with the unrelated “X509Data” value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Affected configurations

NVD

Node

libreofficelibreofficeRange7.2.0–7.2.5

Node

fedoraprojectfedoraMatch34

CPENameOperatorVersion
libreoffice:libreofficelibreofficelt7.2.5

CPE	Name	Operator	Version
libreoffice:libreoffice	libreoffice	lt	7.2.5

CNA Affected

[
  {
    "vendor": "The Document Foundation",
    "product": "LibreOffice",
    "versions": [
      {
        "version": "7.2",
        "status": "affected",
        "lessThan": "7.2.5",
        "versionType": "custom"
      }
    ]
  }
]