CVE-2022-26307: make hash encoding match decoding
authorCaolán McNamara <caolanm@redhat.com>
Mon, 21 Mar 2022 20:58:34 +0000 (20:58 +0000)
committerBastien Roucariès <rouca@debian.org>
Sat, 25 Mar 2023 10:55:37 +0000 (10:55 +0000)
commit1115487142ffcfd4c6b888c680745988aed1fd0e
tree28d2b1ef100cacfbfe2ee0f483059fe916f6110f
parent1ed7a0469bcb3efc8638beb8e4b62917533b2e77
CVE-2022-26307: make hash encoding match decoding

Seeing as old versions of the hash may be in the users config, add a
StorageVersion field to the office config Passwords section which
defaults to 0 to indicate the old hash is in use.

Try the old varient when StorageVersion is 0. When a new encoded master
password it set write StorageVersion of 1 to indicate a new hash is in
use and use the new style when StorageVersion is 1.

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
(cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)

svl: fix crash if user cancels/closes master password dialog

(regression from d7ba5614d90381d68f880ca7e7c5ef8bbb1b1c43)

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133932
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit bbb8617ece6d946957c2eb96287081029bce530f)

Change-Id: I3174c37a5891bfc849984e0ec5c2c392b9c6e7b1
(cherry picked from commit 7e35d53f51bb89ed3cea5f946214afb7d81e1b1e)
origin: https://github.com/LibreOffice/core/commit/c17ba8306704d6d428d673fb0079c4276f0bc256.patch
bug-debian-security: https://security-tracker.debian.org/tracker/CVE-2022-26307
bug: https://www.libreoffice.org/about-us/security/advisories/cve-2022-26307
Signed-off-by: Bastien Roucariès <rouca@debian.org>
Gbp-Pq: Name 0067-CVE-2022-26307-make-hash-encoding-match-decoding.patch
officecfg/registry/schema/org/openoffice/Office/Common.xcs
svl/source/passwordcontainer/passwordcontainer.cxx
svl/source/passwordcontainer/passwordcontainer.hxx
uui/source/iahndl-authentication.cxx