[PATCH 2/4] CVE-2022-26307 make hash encoding match decoding
authorCaolán McNamara <caolanm@redhat.com>
Mon, 21 Mar 2022 20:58:34 +0000 (20:58 +0000)
committerRene Engelhard <rene@debian.org>
Thu, 1 Aug 2024 12:16:43 +0000 (14:16 +0200)
commitceb06529fb6ec5e2f8b81f9b728fee6b9f9b0b40
tree6d93fc5c1e029ee45c505a8630dcc5d917f59598
parentf5ee92491cf073f5b1a2634cd43a0a7c734d7232
[PATCH 2/4] CVE-2022-26307 make hash encoding match decoding

Seeing as old versions of the hash may be in the users config, add a
StorageVersion field to the office config Passwords section which
defaults to 0 to indicate the old hash is in use.

Try the old varient when StorageVersion is 0. When a new encoded master
password it set write StorageVersion of 1 to indicate a new hash is in
use and use the new style when StorageVersion is 1.

Change-Id: I3174c37a5891bfc849984e0ec5c2c392b9c6e7b1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
(cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)

Gbp-Pq: Name 0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
officecfg/registry/schema/org/openoffice/Office/Common.xcs
svl/source/passwordcontainer/passwordcontainer.cxx
svl/source/passwordcontainer/passwordcontainer.hxx
uui/source/iahndl-authentication.cxx