cve-2021-25634
Vulnerability from cvelistv5
Published
2021-10-12 13:33
Modified
2024-09-17 00:46
Severity
Summary
Timestamp Manipulation with Signature Wrapping
References
SourceURLTags
security@documentfoundation.orghttps://www.debian.org/security/2021/dsa-4988Third Party Advisory
security@documentfoundation.orghttps://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634Vendor Advisory
Impacted products
VendorProduct
The Document FoundationLibreOffice
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:11:27.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634"
          },
          {
            "name": "DSA-4988",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4988"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LibreOffice",
          "vendor": "The Document Foundation",
          "versions": [
            {
              "lessThan": "7.0.6",
              "status": "affected",
              "version": "7-0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7-1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "NDS of Ruhr University Bochum"
        }
      ],
      "datePublic": "2021-10-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-17T10:06:24",
        "orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
        "shortName": "Document Fdn."
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634"
        },
        {
          "name": "DSA-4988",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4988"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to 7.0.6 or 7.1.2 or 7.2.0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Timestamp Manipulation with Signature Wrapping",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@documentfoundation.org",
          "DATE_PUBLIC": "2021-10-11T00:00:00.000Z",
          "ID": "CVE-2021-25634",
          "STATE": "PUBLIC",
          "TITLE": "Timestamp Manipulation with Signature Wrapping"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "LibreOffice",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "7-0",
                            "version_value": "7.0.6"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "7-1",
                            "version_value": "7.1.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The Document Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "NDS of Ruhr University Bochum"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295 Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634",
              "refsource": "MISC",
              "url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634"
            },
            {
              "name": "DSA-4988",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4988"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to 7.0.6 or 7.1.2 or 7.2.0"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
    "assignerShortName": "Document Fdn.",
    "cveId": "CVE-2021-25634",
    "datePublished": "2021-10-12T13:33:54.266254Z",
    "dateReserved": "2021-01-19T00:00:00",
    "dateUpdated": "2024-09-17T00:46:33.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-25634\",\"sourceIdentifier\":\"security@documentfoundation.org\",\"published\":\"2021-10-12T14:15:08.290\",\"lastModified\":\"2021-10-18T19:29:46.820\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.\"},{\"lang\":\"es\",\"value\":\"LibreOffice soporta firmas digitales de documentos ODF y macros dentro de documentos, presentando ayudas visuales de que no se ha producido ninguna alteraci\u00f3n del documento desde la \u00faltima firma y que la firma es v\u00e1lida. Una vulnerabilidad de Comprobaci\u00f3n Inapropiada de Certificados en LibreOffice permit\u00eda a un atacante modificar un documento ODF firmado digitalmente para insertar una marca de tiempo de firma adicional que LibreOffice presentar\u00eda incorrectamente como una firma v\u00e1lida firmada en la hora de firma falsa. Este problema afecta a: Las versiones de LibreOffice 7-0 de The Document Foundation anteriores a 7.0.6; las versiones 7-1 anteriores a 7.1.2\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]},{\"source\":\"security@documentfoundation.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.6\",\"matchCriteriaId\":\"7CF22E51-8E68-4B58-8AB3-D326C1097E3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.1.0\",\"versionEndExcluding\":\"7.1.2\",\"matchCriteriaId\":\"BA884385-2527-4F68-9FD5-67ECD9A89F42\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://www.debian.org/security/2021/dsa-4988\",\"source\":\"security@documentfoundation.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634\",\"source\":\"security@documentfoundation.org\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.