Bug 783531 – <net-misc/nextcloud-client-3.1.3: missing URL validation allowed RCE for the server on the desktop client (CVE-2021-22879)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-04-18 00:05:06 UTC]

CVE-2021-22879:

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.

Please stabilize 3.1.3.

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-04-18 00:08:23 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: net-misc/nextcloud-desktop-3.1.3

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-04-18 00:16:24 UTC Comment hidden (obsolete)]

All sanity-check issues have been resolved

[Comment 3 Thomas Deutschmann (RETIRED) 2021-05-25 14:08:41 UTC]

New GLSA request filed.

[Comment 4 Thomas Deutschmann (RETIRED) 2021-05-26 13:12:06 UTC]

x86 stable

[Comment 5 GLSAMaker/CVETool Bot 2021-05-26 13:21:31 UTC]

This issue was resolved and addressed in
 GLSA 202105-37 at https://security.gentoo.org/glsa/202105-37
by GLSA coordinator Thomas Deutschmann (whissi).

[Comment 6 Thomas Deutschmann (RETIRED) 2021-05-26 13:22:08 UTC]

Re-opening for remaining architecture.

[Comment 7 Sergey Popov 2021-05-27 10:12:42 UTC]

amd64 stable