CVE-2021-32800 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v): Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability. CVE-2021-32801 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359h): Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug. CVE-2021-32802 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7): Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`. Please stabilize 21.0.4.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40fab7f64dd6c406a12acc5bc507ee52d61b7434 commit 40fab7f64dd6c406a12acc5bc507ee52d61b7434 Author: Bernard Cafarelli <voyageur@gentoo.org> AuthorDate: 2021-09-16 08:00:51 +0000 Commit: Bernard Cafarelli <voyageur@gentoo.org> CommitDate: 2021-09-16 08:00:51 +0000 www-apps/nextcloud: drop vulnerable versions for 20.x/22.x Bug: https://bugs.gentoo.org/812443 Package-Manager: Portage-3.0.23, Repoman-3.0.3 Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org> www-apps/nextcloud/Manifest | 3 -- www-apps/nextcloud/nextcloud-20.0.11.ebuild | 43 ----------------------------- www-apps/nextcloud/nextcloud-22.0.0.ebuild | 43 ----------------------------- www-apps/nextcloud/nextcloud-22.1.0.ebuild | 43 ----------------------------- 4 files changed, 132 deletions(-)
21.0.4 is fixes over current stable so we can stabilize it indeed. I cleaned older ebuilds in other versions
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3de8e3d79f953b6366fc2ae1eed1eab38e95978 commit f3de8e3d79f953b6366fc2ae1eed1eab38e95978 Author: Bernard Cafarelli <voyageur@gentoo.org> AuthorDate: 2021-09-17 11:25:12 +0000 Commit: Bernard Cafarelli <voyageur@gentoo.org> CommitDate: 2021-09-17 11:25:12 +0000 www-apps/nextcloud: drop vulnerable 21.x version Bug: https://bugs.gentoo.org/812443 Package-Manager: Portage-3.0.23, Repoman-3.0.3 Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org> www-apps/nextcloud/Manifest | 1 - www-apps/nextcloud/nextcloud-21.0.3.ebuild | 43 ------------------------------ 2 files changed, 44 deletions(-)
Thank you!
Unable to check for sanity: > no match for package: www-apps/nextcloud-21.0.4
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=b56f993e2e4fa0778f67ba7d3b8fbb350d4c7386 commit b56f993e2e4fa0778f67ba7d3b8fbb350d4c7386 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-08-10 22:31:11 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-08-10 22:33:19 +0000 [ GLSA 202208-17 ] Nextcloud: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/797253 Bug: https://bugs.gentoo.org/802096 Bug: https://bugs.gentoo.org/812443 Bug: https://bugs.gentoo.org/820368 Bug: https://bugs.gentoo.org/834803 Bug: https://bugs.gentoo.org/835073 Bug: https://bugs.gentoo.org/848873 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202208-17.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+)
GLSA released, all done!
