====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN280
_____________________________________________________________________

DATE                : 18/05/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running LibreOffice versions prior to
                                        6.3.6, 6.4.3.

=====================================================================
https://www.libreoffice.org/about-us/security/advisories/cve-2020-12801/
_____________________________________________________________________


CVE-2020-12801

Title: CVE-2020-12801 Crash-recovered MSOffice encrypted documents
defaulted to not to using encryption on next save

Announced: May 28, 2020

Fixed in: 6.3.6/6.4.3

Description:

If LibreOffice has an encrypted document open and crashes, that document
is auto-saved encrypted. On restart, LibreOffice offers to restore the
document and prompts for the password to decrypt it. If the recovery is
successful, and if the file format of the recovered document was not
LibreOffice's default ODF file format, then affected versions of
LibreOffice default that subsequent saves of the document are
unencrypted.

This may lead to a user accidentally saving a MSOffice file format
document unencrypted while believing it to be encrypted.

In the fixed versions, encrypted recovered MSOffice format documents
default to encrypted save.

Credits:

Thanks to Tomas Florian <tomas@armoreye.ca> for raising awareness of the
issue

References:

    CVE-2020-12801

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================