CVE-2022-26307: 
NixOS vulnerability analysis and mitigation

CVE-2022-26307 is a security vulnerability discovered in LibreOffice that affects the storage of passwords for web connections in the user's configuration database. The vulnerability was disclosed on July 25, 2022, affecting LibreOffice versions 7.2 prior to 7.2.7 and 7.3 prior to 7.3.3. The issue involves the poor encoding of the master key used for password encryption (LibreOffice Advisory, NVD).

The vulnerability stems from a flaw in LibreOffice's implementation of password storage encryption where the master key was poorly encoded, resulting in the weakening of its entropy from 128 bits to 43 bits. The stored passwords are encrypted with a single master key provided by the user, but due to the poor encoding implementation, the security of the stored passwords was significantly compromised (Rapid7, LibreOffice Advisory).

If an attacker gains access to a user's stored configuration data, they could potentially perform a brute force attack to decrypt the stored passwords due to the weakened entropy of the master key. This vulnerability affects all passwords stored for web connections in the user's configuration database (LibreOffice Advisory).

The vulnerability was fixed in LibreOffice versions 7.2.7 and 7.3.3. In these versions, the poor encoding is fixed, and users are prompted via an infobar to reenter their master password to reencrypt old existing vulnerable stored configuration data if it exists (LibreOffice Advisory).