CVE-2021-25636

 

Published at: - 24-02-2022 04:15

Last modified: - 03-06-2022 06:20

Total changes: - 3

Description

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.html or macrosignatures.html stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25636/
• FEDORA-2022-3bbe89c20f-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-25636

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures