PublicDateAtUSN: 2021-10-12 14:15:00 UTC
Candidate: CVE-2021-25634
PublicDate: 2021-10-12 14:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25634
 https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634
 https://www.openwall.com/lists/oss-security/2021/10/11/2
 https://ubuntu.com/security/notices/USN-5153-1
Description:
 LibreOffice supports digital signatures of ODF documents and macros within
 documents, presenting visual aids that no alteration of the document
 occurred since the last signing and that the signature is valid. An
 Improper Certificate Validation vulnerability in LibreOffice allowed an
 attacker to modify a digitally signed ODF document to insert an additional
 signing time timestamp which LibreOffice would incorrectly present as a
 valid signature signed at the bogus signing time. This issue affects: The
 Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions
 prior to 7.1.2.
Ubuntu-Description:
Notes:
 mdeslaur> The code changes required to fix this issue in Ubuntu 18.04 LTS
 mdeslaur> are extensive. We will not be fixing this issue in Ubuntu 18.04
 mdeslaur> LTS.
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]


Patches_libreoffice:
 upstream: https://github.com/LibreOffice/core/commit/ad5930e87e788780a255523f106deb1dde5d7b37 (bp)
 upstream: https://github.com/LibreOffice/core/commit/abe77c4fcb9ea97d9fff07eaea6d8863bcba5b02
 upstream: https://github.com/LibreOffice/core/commit/94ce59dd02fcfcaa1eb4f195b45a9a2edbd58242
upstream_libreoffice: released (7.0.6,7.1.2,1:7.2.0-2)
esm-infra/xenial_libreoffice: not-affected (code not present)
trusty_libreoffice: ignored (out of standard support)
xenial_libreoffice: ignored (out of standard support)
bionic_libreoffice: ignored
focal_libreoffice: released (1:6.4.7-0ubuntu0.20.04.2)
hirsute_libreoffice: not-affected (1:7.1.2~rc2-0ubuntu2)
impish_libreoffice: not-affected (1:7.2.1-0ubuntu3)
jammy_libreoffice: not-affected
devel_libreoffice: not-affected