Bug 812491 (CVE-2021-35946, CVE-2021-35947, CVE-2021-35948, CVE-2021-35949)

Summary:	<www-apps/owncloud-10.8.0: multiple vulnerabilities (CVE-2021-{35946,35947,35948,35949})
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	voyageur, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-09-10 19:36:56 UTC

CVE-2021-35946 (https://owncloud.com/security-advisories/cve-2021-35946/):

A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.

CVE-2021-35947 (https://owncloud.com/security-advisories/cve-2021-35947/):

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL.

CVE-2021-35948 (https://owncloud.com/security-advisories/cve-2021-35948/):

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.

CVE-2021-35949 (https://owncloud.com/security-advisories/cve-2021-35949/):

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.

Please cleanup <10.8.0.

Comment 1 Larry the Git Cow gentoo-dev

2021-09-15 10:40:22 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cdd0ebd79e5f3cbcc7aa630fe6ffda67683f0bb9

commit cdd0ebd79e5f3cbcc7aa630fe6ffda67683f0bb9
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2021-09-15 10:40:17 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2021-09-15 10:40:17 +0000

    www-apps/owncloud: drop vulnerable version
    
    Bug: https://bugs.gentoo.org/812491
    Package-Manager: Portage-3.0.23, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/owncloud/Manifest                         |  1 -
 .../owncloud-10.7.0-share_data_exposure.patch      | 78 ----------------------
 www-apps/owncloud/owncloud-10.7.0-r1.ebuild        | 49 --------------
 3 files changed, 128 deletions(-)

Comment 2 Bernard Cafarelli gentoo-dev

2021-09-15 10:40:43 UTC

Done, only 10.8.0 is left in tree

Comment 3 John Helmert III archtester

2021-09-15 19:25:04 UTC

Thanks!

Comment 4 John Helmert III archtester

2022-01-17 20:49:15 UTC

All unstable, no GLSA.