PT-2021-6784 · Document Foundation+9 · Libreoffice+9
Nds Of
·
Published
2021-01-19
·
Updated
2023-03-27
·
CVE-2021-25636
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
LibreOffice versions 7.2 prior to 7.2.5
Description
The issue is related to improper certificate validation in LibreOffice, allowing an attacker to create a digitally signed ODF document by manipulating the
documentsignatures.xml or macrosignatures.xml stream within the document. This manipulation involves adding both X509Data and KeyValue children of the KeyInfo tag, causing LibreOffice to verify using the KeyValue but report verification with the unrelated X509Data value. This can enable an attacker to bypass security restrictions.Recommendations
For LibreOffice versions 7.2 prior to 7.2.5, update to version 7.2.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of digital signatures in ODF documents until the update is applied. Avoid using the
X509Data and KeyValue parameters in the KeyInfo tag of the documentsignatures.xml or macrosignatures.xml stream within the document to minimize the risk of exploitation.Fix
Improper Verification of Cryptographic Signature
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Libreoffice
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu