Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in nextcloud
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in nextcloud
ID: openSUSE-SU-2020:0220-1
Distribution: SUSE
Plattformen: SUSE Package Hub for SUSE Linux Enterprise 12, SUSE openSUSE Backports SLE-15, SUSE openSUSE Leap 15.1, SUSE openSUSE Backports SLE-15-SP1
Datum: So, 16. Februar 2020, 01:09
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8118
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8119
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15623
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15624
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15613
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15621
Applikationen: Nextcloud

Originalnachricht

   openSUSE Security Update: Security update for nextcloud
______________________________________________________________________________

Announcement ID: openSUSE-SU-2020:0220-1
Rating: moderate
References: #1162766 #1162775 #1162776 #1162781 #1162782
#1162784
Cross-References: CVE-2019-15613 CVE-2019-15621 CVE-2019-15623
CVE-2019-15624 CVE-2020-8118 CVE-2020-8119

Affected Products:
openSUSE Leap 15.1
openSUSE Backports SLE-15-SP1
openSUSE Backports SLE-15
SUSE Package Hub for SUSE Linux Enterprise 12
______________________________________________________________________________

An update that fixes 6 vulnerabilities is now available.

Description:

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour
on the file extension when checking file mimetypes (boo#1162766)
- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused
the server to send it's domain and user IDs to the Nextcloud Lookup
Server without any further data when the Lookup server is disabled
(boo#1162775)
- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group
admins to create users with IDs of system folders (boo#1162776)
- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of
previews and files when a file-drop share link is opened via the gallery
app (boo#1162781)
- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request
forgery allowed to detect local and remote services when adding a new
subscription in the calendar application (boo#1162782)
- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes
sharees to be able to reshare with write permissions when sharing the
mount point of a share they received, as a public link (boo#1162784)
- To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

- Fix NC-SA-2020-001
- To many changes. For detail see: https://nextcloud.com/changelog/


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended
installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2020-220=1

- openSUSE Backports SLE-15-SP1:

zypper in -t patch openSUSE-2020-220=1

- openSUSE Backports SLE-15:

zypper in -t patch openSUSE-2020-220=1

- SUSE Package Hub for SUSE Linux Enterprise 12:

zypper in -t patch openSUSE-2020-220=1



Package List:

- openSUSE Leap 15.1 (noarch):

nextcloud-15.0.14-lp151.2.3.1

- openSUSE Backports SLE-15-SP1 (noarch):

nextcloud-15.0.14-bp151.3.3.1

- openSUSE Backports SLE-15 (noarch):

nextcloud-13.0.12-bp150.19.1

- SUSE Package Hub for SUSE Linux Enterprise 12 (noarch):

nextcloud-13.0.12-19.1


References:

https://www.suse.com/security/cve/CVE-2019-15613.html
https://www.suse.com/security/cve/CVE-2019-15621.html
https://www.suse.com/security/cve/CVE-2019-15623.html
https://www.suse.com/security/cve/CVE-2019-15624.html
https://www.suse.com/security/cve/CVE-2020-8118.html
https://www.suse.com/security/cve/CVE-2020-8119.html
https://bugzilla.suse.com/1162766
https://bugzilla.suse.com/1162775
https://bugzilla.suse.com/1162776
https://bugzilla.suse.com/1162781
https://bugzilla.suse.com/1162782
https://bugzilla.suse.com/1162784

--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung