Bug 812443 (CVE-2021-32800, CVE-2021-32801, CVE-2021-32802) – <www-apps/nextcloud-{20.0.12,21.0.4,21.1.0}: multiple vulnerabilities (CVE-2021-{32800,32801,32802})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2021-09-10 11:53:20 UTC]

CVE-2021-32800 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v):

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

CVE-2021-32801 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359h):

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

CVE-2021-32802 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7):

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.


Please stabilize 21.0.4.

[Comment 1 Larry the Git Cow 2021-09-16 08:01:02 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40fab7f64dd6c406a12acc5bc507ee52d61b7434

commit 40fab7f64dd6c406a12acc5bc507ee52d61b7434
Author:     Bernard Cafarelli <[e-mail]>
AuthorDate: 2021-09-16 08:00:51 +0000
Commit:     Bernard Cafarelli <[e-mail]>
CommitDate: 2021-09-16 08:00:51 +0000

    www-apps/nextcloud: drop vulnerable versions for 20.x/22.x
    
    Bug: https://bugs.gentoo.org/812443
    Package-Manager: Portage-3.0.23, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <[e-mail]>

 www-apps/nextcloud/Manifest                 |  3 --
 www-apps/nextcloud/nextcloud-20.0.11.ebuild | 43 -----------------------------
 www-apps/nextcloud/nextcloud-22.0.0.ebuild  | 43 -----------------------------
 www-apps/nextcloud/nextcloud-22.1.0.ebuild  | 43 -----------------------------
 4 files changed, 132 deletions(-)

[Comment 2 Bernard Cafarelli 2021-09-16 08:03:17 UTC]

21.0.4 is fixes over current stable so we can stabilize it indeed. I cleaned older ebuilds in other versions

[Comment 3 Larry the Git Cow 2021-09-17 11:25:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3de8e3d79f953b6366fc2ae1eed1eab38e95978

commit f3de8e3d79f953b6366fc2ae1eed1eab38e95978
Author:     Bernard Cafarelli <[e-mail]>
AuthorDate: 2021-09-17 11:25:12 +0000
Commit:     Bernard Cafarelli <[e-mail]>
CommitDate: 2021-09-17 11:25:12 +0000

    www-apps/nextcloud: drop vulnerable 21.x version
    
    Bug: https://bugs.gentoo.org/812443
    Package-Manager: Portage-3.0.23, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <[e-mail]>

 www-apps/nextcloud/Manifest                |  1 -
 www-apps/nextcloud/nextcloud-21.0.3.ebuild | 43 ------------------------------
 2 files changed, 44 deletions(-)

[Comment 4 John Helmert III 2021-09-17 12:49:46 UTC]

Thank you!

[Comment 5 NATTkA bot 2021-10-29 07:16:35 UTC]

Unable to check for sanity:

> no match for package: www-apps/nextcloud-21.0.4

[Comment 6 Larry the Git Cow 2022-08-10 22:33:46 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=b56f993e2e4fa0778f67ba7d3b8fbb350d4c7386

commit b56f993e2e4fa0778f67ba7d3b8fbb350d4c7386
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-10 22:31:11 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-10 22:33:19 +0000

    [ GLSA 202208-17 ] Nextcloud: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/797253
    Bug: https://bugs.gentoo.org/802096
    Bug: https://bugs.gentoo.org/812443
    Bug: https://bugs.gentoo.org/820368
    Bug: https://bugs.gentoo.org/834803
    Bug: https://bugs.gentoo.org/835073
    Bug: https://bugs.gentoo.org/848873
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-17.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

[Comment 7 John Helmert III 2022-08-10 22:35:37 UTC]

GLSA released, all done!