Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
openSUSE: Security Advisory for nextcloud (openSUSE-SU-2020:1652-1)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The remote host is missing an update for the 'nextcloud' package(s) announced via the openSUSE-SU-2020:1652-1 advisory.
Insight
Insight
This update for nextcloud fixes the following issues: nextcloud version 20.0.0 fix some security issues: - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 (CVE-2020-8228) Missing rate limit on signup page - NC-SA-2020-029 (CVE-2020-8233, boo#1177346) Re-Sharing allows increase of privileges - NC-SA-2020-026 Password of share by mail is not hashed when given on the create share call - NC-SA-2020-023 Increase random used for encryption - Update to 19.0.3 - Fix possible leaking scope in Flow (server#22410) - Combine body-login rules in theming and fix twofactor and guest styling on bright colors (server#22427) - Show better quota warning for group folders and external storage (server#22442) - Add php docs build script (server#22448) - Fix clicks on actions menu of non opaque file rows in acceptance tests (server#22503) - Fix writing BLOBs to postgres with recent contacts interaction (server#22515) - Set the mount id before calling storage wrapper (server#22519) - Fix S3 error handling (server#22521) - Only disable zip64 if the size is known (server#22537) - Change free space calculation (server#22553) - Do not keep the part file if the forbidden exception has no retry set (server#22560) - Fix app password updating out of bounds (server#22569) - Use the correct root to determinate the webroot for the resource (server#22579) - Upgrade icewind/smb to 3.2.7 (server#22581) - Bump elliptic from 6.4.1 to 6.5.3 (notifications#732) - Fixes regression that prevented you from toggling the encryption flag (privacy#489) - Match any non-whitespace character in filesystem pattern (serverinfo#229) - Catch StorageNotAvailable exceptions (text#1001) - Harden read only check on public endpoints (text#1017) - Harden check when using token from memcache (text#1020) - Sessionid is an int (text#1029) - Only overwrite Ctrl-f when text is focused (text#990) - Set the X-Requested-With header on dav requests (viewer#582) - Update to 19.0.2 - [stable19] lower minimum search length to 2 characters (server#21782) - [stable19] Call openssl_pkey_export with $config and log errors. (server#21804) - [stable19] Improve error reporting on sharing errors (server#21806) - [stable19] Do not log RequestedRangeNotSatisfiable exceptions in DAV (server#21840) - [stable19] Fix parsing of language code (server#21857) - [stable19] fix typo in revokeShare() (server#21876) - [stable19] Discourage webauthn user interaction (server#21917) - [stable19] Encryption is ... Description truncated. Please see the references for more information.
Affected Software
Affected Software
'nextcloud' package(s) on openSUSE Leap 15.2, openSUSE Leap 15.1.
Detection Method
Detection Method
Checks if a vulnerable package version is present on the target host.
Solution
Solution
Please install the updated package(s).