LibreOffice Improper Certificate Validation Vulnerability Allowing Signature Forgery

A vulnerability in LibreOffice related to improper certificate validation has been identified, allowing an attacker to manipulate digital signatures on ODF documents. The attacker can self-sign a document with an untrusted signature, then alter it to use an invalid or unknown signature algorithm. LibreOffice erroneously accepts such signatures as valid, presenting them as trusted. This issue affects LibreOffice versions 7.0 prior to 7.0.5 and 7.1 prior to 7.1.1.

Impact

Exploitation of this vulnerability could lead to unauthorized acceptance of manipulated digital signatures, potentially allowing for fraudulent document modifications to be recognized as legitimate.

Remediation

Users can upgrade to LibreOffice versions 7.0.5 or 7.1.1 to address this vulnerability.