CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit

Critical 10.0 Published 25 Jun 2024 Updated 1 Aug 2024

Attackers can bypass TLS certificate validation in LibreOfficeKit mode, enabling man-in-the-middle attacks against remote resource fetches.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-5261?

CVE-2024-5261 is a critical vulnerability in Libreoffice Libreoffice, published on 25 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification

LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents.

LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.

In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false)

In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.

This issue affects LibreOffice before version 24.2.4.

Weakness: CWE-295

Which versions are affected by CVE-2024-5261?

It affects 1 product.

Linux distribution packages (9)

`libreoffice` SUSE:Linux Enterprise Module for Package Hub 15 SP5	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`24.8.1.2-48.64.2`
`libreoffice` SUSE:Linux Enterprise Workstation Extension 12 SP5	All versions	`24.8.1.2-48.64.2`
`libreoffice` SUSE:Linux Enterprise Workstation Extension 15 SP5	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` SUSE:Linux Enterprise Workstation Extension 15 SP6	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` openSUSE:Leap 15.5	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` openSUSE:Leap 15.6	All versions	`24.8.1.2-150500.20.11.2`
`libreoffice` openSUSE:Tumbleweed	All versions	`24.2.5.2-1.1`

Products include Libreoffice Libreoffice.

How do I fix CVE-2024-5261?

Upgrade to a fixed version.

Is CVE-2024-5261 being exploited?

There is no known exploitation of CVE-2024-5261 in the wild and no public exploit code.

All Libreoffice Libreoffice vulnerabilities

Sources

Also known as BELL-CVE-2024-5261, DEBIAN-CVE-2024-5261, GHSA-rvcj-9xfm-m9hr, MGASA-2024-0268, SUSE-SU-2024:3576-1, SUSE-SU-2024:3577-1 and 3 more.