Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 774252 (CVE-2020-8296, CVE-2021-22877, CVE-2021-22878) - <www-apps/nextcloud-20.0.6: multiple vulnerabilities (CVE-2020-8296, CVE-2021-{22877,22878})
Summary: <www-apps/nextcloud-20.0.6: multiple vulnerabilities (CVE-2020-8296, CVE-2021...
Status: RESOLVED FIXED
Alias: CVE-2020-8296, CVE-2021-22877, CVE-2021-22878
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-03-05 02:51 UTC by John Helmert III
Modified: 2021-05-25 16:30 UTC (History)
3 users (show)

See Also:
Package list:
www-apps/nextcloud-20.0.8
Runtime testing required: ---
nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-05 02:51:29 UTC 
CVE-2020-8296 (https://nextcloud.com/security/advisory/?id=NC-SA-2021-006):

Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

CVE-2021-22877 (https://nextcloud.com/security/advisory/?id=NC-SA-2021-004):

A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.

CVE-2021-22878 (https://nextcloud.com/security/advisory/?id=NC-SA-2021-005):

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.


These are fixed in 20.0.6, please stabilize a suitable version.
Comment 1 Agostino Sarubbo gentoo-dev 2021-03-05 14:18:48 UTC 
amd64 stable
Comment 2 Agostino Sarubbo gentoo-dev 2021-03-05 14:19:46 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2021-05-25 16:30:09 UTC 
We currently cannot target multiple branches with unique slots per ebuild in GLSA.

Repository is clean, all done.