Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 835073 (CVE-2022-24741, CVE-2022-24888, CVE-2022-24889) - <www-apps/nextcloud-{21.0.8,23.0.1}: DoS via crafted file upload
Summary: <www-apps/nextcloud-{21.0.8,23.0.1}: DoS via crafted file upload
Status: CONFIRMED
Alias: CVE-2022-24741, CVE-2022-24888, CVE-2022-24889
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [stable?]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-13 13:52 UTC by John Helmert III
Modified: 2022-05-03 00:58 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-13 13:52:46 UTC
CVE-2022-24741 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89):

Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.

Please stabilize 21.0.8, 23.0.1.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-03 00:58:31 UTC
CVE-2022-24888 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp):
https://github.com/nextcloud/server/pull/29895

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.

CVE-2022-24889 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6):
https://hackerone.com/reports/1403614

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.