Bug 907268 (CVE-2023-32318)

Summary:	<www-apps/nextcloud-{25.0.6,26.0.1}: text session not destroyed on logout
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	voyageur, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	911410
Bug Blocks:

Description John Helmert III archtester

2023-05-27 20:25:29 UTC

CVE-2023-32318 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38):

Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.

Comment 1 Bernard Cafarelli gentoo-dev

2023-07-29 08:00:37 UTC

I asked for 25.0.7 stabilization in bug 911410 and 26.0 is cleaned (only 26.0.4 left in tree now)

Comment 2 Larry the Git Cow gentoo-dev

2023-07-31 22:20:23 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f77024d3308e9213d3473c1b5a955c95bf315564

commit f77024d3308e9213d3473c1b5a955c95bf315564
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2023-07-31 22:20:08 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2023-07-31 22:20:08 +0000

    www-apps/nextcloud: drop 25.0.4
    
    Bug: https://bugs.gentoo.org/904941
    Bug: https://bugs.gentoo.org/907268
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                |  1 -
 www-apps/nextcloud/nextcloud-25.0.4.ebuild | 43 ------------------------------
 2 files changed, 44 deletions(-)

Comment 3 John Helmert III archtester

2023-08-16 06:00:52 UTC

Thanks!