certfr_avis - certfr-2020-avi-298

CERTFR-2020-AVI-298

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans LibreOffice. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Libreoffice	LibreOffice	LibreOffice versions 6.3.x antérieures à 6.3.6
	Libreoffice	LibreOffice	LibreOffice versions antérieures à 6.4.3

References

Title

Publication Time

Tags

Bulletin de sécurité LibreOffice cve-2020-12801 du 18 mai 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "LibreOffice versions 6.3.x ant\u00e9rieures \u00e0 6.3.6",
      "product": {
        "name": "LibreOffice",
        "vendor": {
          "name": "Libreoffice",
          "scada": false
        }
      }
    },
    {
      "description": "LibreOffice versions ant\u00e9rieures \u00e0 6.4.3",
      "product": {
        "name": "LibreOffice",
        "vendor": {
          "name": "Libreoffice",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-12801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-12801"
    }
  ],
  "initial_release_date": "2020-05-18T00:00:00",
  "last_revision_date": "2020-05-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-298",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans LibreOffice. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans LibreOffice",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 LibreOffice cve-2020-12801 du 18 mai 2020",
      "url": "https://www.libreoffice.org/about-us/security/advisories/cve-2020-12801/"
    }
  ]
}

CVE-2020-12801 (GCVE-0-2020-12801)

Vulnerability from cvelistv5

Published

2020-05-18 14:20

Modified

2024-11-18 17:29

Severity ?

CWE

CWE-311 - Missing Encryption of Sensitive Data

Summary

If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3.

References

URL

Tags

	https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801
	http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00011.html	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html	mailing-list

Impacted products

	Vendor	Product	Version
	The Document Foundation	LibreOffice	Version: 6-3 series < 6.3.6 Version: 6-4 series < 6.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:04:22.875Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801"
          },
          {
            "name": "openSUSE-SU-2020:0786",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00011.html"
          },
          {
            "name": "[debian-lts-announce] 20231231 [SECURITY] [DLA 3703-1] libreoffice security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-12801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-10T15:37:49.768784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-18T17:29:42.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LibreOffice",
          "vendor": "The Document Foundation",
          "versions": [
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "6-3 series",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.3",
              "status": "affected",
              "version": "6-4 series",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thanks to Tomas Florian \u003ctomas@armoreye.ca\u003e for raising awareness of the issue"
        }
      ],
      "datePublic": "2020-05-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice\u0027s default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311 Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-31T14:06:29.477186",
        "orgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
        "shortName": "Document Fdn."
      },
      "references": [
        {
          "url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801"
        },
        {
          "name": "openSUSE-SU-2020:0786",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00011.html"
        },
        {
          "name": "[debian-lts-announce] 20231231 [SECURITY] [DLA 3703-1] libreoffice security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fe7d05b-1353-44cc-8b7a-1e416936dff2",
    "assignerShortName": "Document Fdn.",
    "cveId": "CVE-2020-12801",
    "datePublished": "2020-05-18T14:20:08.325905Z",
    "dateReserved": "2020-05-12T00:00:00",
    "dateUpdated": "2024-11-18T17:29:42.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2020-AVI-298

Vulnerability from certfr_avis

Solution

CVE-2020-12801 (GCVE-0-2020-12801)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature