Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 870880 (CVE-2022-39211) - <www-apps/nextcloud-{23.0.8,24.0.4}: ssrf vulnerability
Summary: <www-apps/nextcloud-{23.0.8,24.0.4}: ssrf vulnerability
Status: RESOLVED FIXED
Alias: CVE-2022-39211
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/nextcloud/security...
Whiteboard: B4 [noglsa]
Keywords:
Depends on: 872554
Blocks:
  Show dependency tree
 
Reported: 2022-09-17 16:51 UTC by John Helmert III
Modified: 2022-09-24 22:38 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-17 16:51:43 UTC 
CVE-2022-39211:

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

Please stabilize 23.0.8 and cleanup remaining affected versions.
Comment 1 Bernard Cafarelli gentoo-dev 2022-09-23 19:23:11 UTC 
Stable request for 23.0.8 in bug 872554, dropped 24.0.x old versions
Comment 2 Larry the Git Cow gentoo-dev 2022-09-23 19:27:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0acede51fe56511fd0892b63634617e13f39d59c

commit 0acede51fe56511fd0892b63634617e13f39d59c
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2022-09-23 19:22:02 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2022-09-23 19:23:37 +0000

    www-apps/nextcloud: drop 24.0.3, 24.0.4
    
    Bug: https://bugs.gentoo.org/870880
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                |  2 --
 www-apps/nextcloud/nextcloud-24.0.3.ebuild | 43 ------------------------------
 www-apps/nextcloud/nextcloud-24.0.4.ebuild | 43 ------------------------------
 3 files changed, 88 deletions(-)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-24 20:07:55 UTC 
Missed cleaning up 23.0.7, I think?

Looks like upstream says this is low impact, so we'll noglsa since it doesn't seem very exploitable on its own.
Comment 4 Bernard Cafarelli gentoo-dev 2022-09-24 21:56:22 UTC 
Doing cleanup indeed, nice to see stabilization went fast (ALLARCHES++)
Comment 5 Larry the Git Cow gentoo-dev 2022-09-24 21:57:08 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=41cd8c1b766690f6af80c80798dd602d91b350b2

commit 41cd8c1b766690f6af80c80798dd602d91b350b2
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2022-09-24 21:56:57 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2022-09-24 21:56:57 +0000

    www-apps/nextcloud: drop 23.0.7
    
    Bug: https://bugs.gentoo.org/870880
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                |  1 -
 www-apps/nextcloud/nextcloud-23.0.7.ebuild | 43 ------------------------------
 2 files changed, 44 deletions(-)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-24 22:38:23 UTC 
Thank you!