Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 907268 (CVE-2023-32318) - <www-apps/nextcloud-{25.0.6,26.0.1}: text session not destroyed on logout
Summary: <www-apps/nextcloud-{25.0.6,26.0.1}: text session not destroyed on logout
Status: IN_PROGRESS
Alias: CVE-2023-32318
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa?]
Keywords:
Depends on: 911410
Blocks:
  Show dependency tree
 
Reported: 2023-05-27 20:25 UTC by John Helmert III
Modified: 2023-08-16 06:00 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-05-27 20:25:29 UTC 
CVE-2023-32318 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38):

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
Comment 1 Bernard Cafarelli gentoo-dev 2023-07-29 08:00:37 UTC 
I asked for 25.0.7 stabilization in bug 911410 and 26.0 is cleaned (only 26.0.4 left in tree now)
Comment 2 Larry the Git Cow gentoo-dev 2023-07-31 22:20:23 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f77024d3308e9213d3473c1b5a955c95bf315564

commit f77024d3308e9213d3473c1b5a955c95bf315564
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2023-07-31 22:20:08 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2023-07-31 22:20:08 +0000

    www-apps/nextcloud: drop 25.0.4
    
    Bug: https://bugs.gentoo.org/904941
    Bug: https://bugs.gentoo.org/907268
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                |  1 -
 www-apps/nextcloud/nextcloud-25.0.4.ebuild | 43 ------------------------------
 2 files changed, 44 deletions(-)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-08-16 06:00:52 UTC 
Thanks!