Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 812443 (CVE-2021-32800, CVE-2021-32801, CVE-2021-32802) - <www-apps/nextcloud-{20.0.12,21.0.4,21.1.0}: multiple vulnerabilities (CVE-2021-{32800,32801,32802})
Summary: <www-apps/nextcloud-{20.0.12,21.0.4,21.1.0}: multiple vulnerabilities (CVE-20...
Status: IN_PROGRESS
Alias: CVE-2021-32800, CVE-2021-32801, CVE-2021-32802
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa?]
Keywords:
Depends on: 813426
Blocks:
  Show dependency tree
 
Reported: 2021-09-10 11:53 UTC by John Helmert III
Modified: 2021-09-17 12:49 UTC (History)
3 users (show)

See Also:
Package list:
www-apps/nextcloud-21.0.4
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2021-09-10 11:53:20 UTC
CVE-2021-32800 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gv5w-8q25-785v):

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.

CVE-2021-32801 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mcpf-v65v-359h):

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

CVE-2021-32802 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m682-v4g9-wrq7):

Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.


Please stabilize 21.0.4.
Comment 1 Larry the Git Cow gentoo-dev 2021-09-16 08:01:02 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40fab7f64dd6c406a12acc5bc507ee52d61b7434

commit 40fab7f64dd6c406a12acc5bc507ee52d61b7434
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2021-09-16 08:00:51 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2021-09-16 08:00:51 +0000

    www-apps/nextcloud: drop vulnerable versions for 20.x/22.x
    
    Bug: https://bugs.gentoo.org/812443
    Package-Manager: Portage-3.0.23, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                 |  3 --
 www-apps/nextcloud/nextcloud-20.0.11.ebuild | 43 -----------------------------
 www-apps/nextcloud/nextcloud-22.0.0.ebuild  | 43 -----------------------------
 www-apps/nextcloud/nextcloud-22.1.0.ebuild  | 43 -----------------------------
 4 files changed, 132 deletions(-)
Comment 2 Bernard Cafarelli gentoo-dev 2021-09-16 08:03:17 UTC
21.0.4 is fixes over current stable so we can stabilize it indeed. I cleaned older ebuilds in other versions
Comment 3 Larry the Git Cow gentoo-dev 2021-09-17 11:25:25 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3de8e3d79f953b6366fc2ae1eed1eab38e95978

commit f3de8e3d79f953b6366fc2ae1eed1eab38e95978
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2021-09-17 11:25:12 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2021-09-17 11:25:12 +0000

    www-apps/nextcloud: drop vulnerable 21.x version
    
    Bug: https://bugs.gentoo.org/812443
    Package-Manager: Portage-3.0.23, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/nextcloud/Manifest                |  1 -
 www-apps/nextcloud/nextcloud-21.0.3.ebuild | 43 ------------------------------
 2 files changed, 44 deletions(-)
Comment 4 John Helmert III gentoo-dev Security 2021-09-17 12:49:46 UTC
Thank you!