PT-2021-5406 · Apache · Apache Openoffice+1

Christian Mainka + 3 · Published 2021-09-23 · Updated 2021-10-19 · CVE-2021-41831

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.11

Description The issue is related to errors in checking signed documents, which can be exploited by a remote attacker to compromise the integrity of information. It is possible for an attacker to manipulate the timestamp of signed documents.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 to resolve the issue. As a temporary workaround, consider restricting the use of signed documents until the update is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2021-06247

CVE-2021-41831

Affected Products

Apache Openoffice

Openoffice

References · 10

• https://lists.apache.org/thread.html/ra74d5057cdc781a36286a83e8bcbc90a7678f030ae73339c35dfc4f9%40%3Cusers.openoffice.apache.org%3E · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06247 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41831 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41831 · Vendor Advisory
• https://t.me/cvenotify/22272 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021101111 · Note
• https://openoffice.org/security/cves/CVE-2021-41831.html · Note
• https://lists.apache.org/thread.html/rc5c277cb83e335696657c5f27da1d1e2b5cb48346b0b55415a233757%40%3Cannounce.apache.org%3E · Note
• https://t.me/cvenotify/22249 · Telegram Post
• https://lists.apache.org/thread.html/rc5c277cb83e335696657c5f27da1d1e2b5cb48346b0b55415a233757@%3Cannounce.apache.org%3E · Note