CVE-2022-37401 - Apache OpenOffice Weak Master Keys

Back Back to CVE browser

HIGH

Apache OpenOffice Weak Master Keys

Published Aug 13, 2022

8.8

HIGH

CVSS 3.1

EPSS 1.77%

Description

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice

Affected products

Vendor Apache Software Foundation Product Apache OpenOffice Default
n/a
- Version
  Apache OpenOffice 4
  Status
  affected
  Constraints
  <4.1.13

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache OpenOffice

n/a

Version	Status	Constraints
Apache OpenOffice 4	affected	<4.1.13

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-331

References (3)

http://www.openwall.com/lists/oss-security/2022/08/13/2
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-40034
Advisory
https://www.openoffice.org/security/cves/CVE-2022-37401.html
x_refsource_MISCMitigationPatchVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/08/13/2		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-40034		Advisory
https://www.openoffice.org/security/cves/CVE-2022-37401.html		x_refsource_MISCMitigationPatchVendor Advisory