Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Incorrect trust validation of signature with ambiguous KeyInfo children (The Document Foundation LibreOffice)

CVE-2021-25636
HIGH 7.5

En bref

Source
NVD
EPSS
EPSS 0.95 % · centile 61 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Document Fdn.
Statut NVD
Modified

Rechercher sur…

Description

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Faiblesses (CWE)

  • CWE-347 — Vérification incorrecte d'une signature cryptographique
  • CWE-295 — Validation incorrecte de certificat

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 5.0AV:N/AC:L/Au:N/C:N/I:P/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
The Document Foundation · LibreOfficeaffected 7.2 < 7.2.5

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD