From d2e9a822e81226acd3d5dbad77e9f58abf3b15d2 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 15 Jul 2020 09:09:17 +0200 Subject: Add SA updates for July Signed-off-by: Joas Schilling --- advisories/advisories.rss | 18 ++++++++++++++++++ advisories/full-list.php | 30 ++++++++++++++++++++++++++++++ advisories/nc-sa-2020-023.php | 36 ++++++++++++++++++++++++++++++++++++ advisories/nc-sa-2020-025.php | 2 +- advisories/nc-sa-2020-026.php | 35 +++++++++++++++++++++++++++++++++++ advisories/nc-sa-2020-028.php | 34 ++++++++++++++++++++++++++++++++++ 6 files changed, 154 insertions(+), 1 deletion(-) create mode 100644 advisories/nc-sa-2020-023.php create mode 100644 advisories/nc-sa-2020-026.php create mode 100644 advisories/nc-sa-2020-028.php diff --git a/advisories/advisories.rss b/advisories/advisories.rss index 75eb86f9..11eb0159 100644 --- a/advisories/advisories.rss +++ b/advisories/advisories.rss @@ -5,6 +5,18 @@ https://nextcloud.com/security/advisories/ The Nextcloud security advisories as a RSS feed 1800 + Preferred providers: Possible denial of service when entering a long password (NC-SA-2020-028) + Improper check of inputs in Preferred providers app 1.6.0 allowed to perform a denial of service attack when using a very long password.<br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2020-028">For more information please consult the official advisory.</a></strong></p> + https://nextcloud.com/security/advisory/?id=nC-SA-2020-028 + https://nextcloud.com/security/advisory/?id=nC-SA-2020-028 + Tue, 16 Jun 2020 14:00:00 +0200 + + Server: Password of share by mail is not hashed when given on the create share call (NC-SA-2020-026) + A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.<br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2020-026">For more information please consult the official advisory.</a></strong></p> + https://nextcloud.com/security/advisory/?id=nC-SA-2020-026 + https://nextcloud.com/security/advisory/?id=nC-SA-2020-026 + Thu, 04 Jun 2020 14:00:00 +0200 + Deck App: Missing permission check on resharing a board (NC-SA-2020-025) Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.<br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2020-025">For more information please consult the official advisory.</a></strong></p> https://nextcloud.com/security/advisory/?id=nC-SA-2020-025 @@ -16,6 +28,12 @@ https://nextcloud.com/security/advisory/?id=nC-SA-2020-024 https://nextcloud.com/security/advisory/?id=nC-SA-2020-024 Thu, 16 Apr 2020 14:00:00 +0200 + + Server: Increase random used for encryption (NC-SA-2020-023) + A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.<br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2020-023">For more information please consult the official advisory.</a></strong></p> + https://nextcloud.com/security/advisory/?id=nC-SA-2020-023 + https://nextcloud.com/security/advisory/?id=nC-SA-2020-023 + Thu, 04 Jun 2020 14:00:00 +0200 Deck App: Improper access control allows injecting tasks into other users decks (NC-SA-2020-022) Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks.<br/><hr/><p><strong><a href="https://nextcloud.com/security/advisory/?id=nC-SA-2020-022">For more information please consult the official advisory.</a></strong></p> diff --git a/advisories/full-list.php b/advisories/full-list.php index 671f8baf..584d4d19 100644 --- a/advisories/full-list.php +++ b/advisories/full-list.php @@ -2,6 +2,36 @@

2020

+

Preferred providers 1.7.0

+ + +

Nextcloud Server 19.0.1

+ + +

Nextcloud Server 18.0.6

+ + +

Nextcloud Server 19.0.0

+ + +

Nextcloud Server 18.0.5

+ + +

Nextcloud Server 17.0.7

+ +

Deck App 1.0.1

  • Improper access control allows injecting tasks into other users decks (NC-SA-2020-022) 2020-05-15
    • diff --git a/advisories/nc-sa-2020-023.php b/advisories/nc-sa-2020-023.php new file mode 100644 index 00000000..17385eef --- /dev/null +++ b/advisories/nc-sa-2020-023.php @@ -0,0 +1,36 @@ +
    +
    +

    Security Advisory

    + Back to advisories +
    +
    +
    +
    +

    Increase random used for encryption (NC-SA-2020-023)

    +

    4th June 2020

    +

    Risk level: Low

    +

    CVSS v3 Base Score: 2.2 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)

    +

    CWE: Cryptographic Issues - Generic (CWE-310)

    +

    HackerOne report: 852841

    +

    Description

    +

    A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

    +

    Affected Software

    +
      +
    • Nextcloud Server < 19.0.0 (CVE-2020-8173)
      • +
    • Nextcloud Server < 18.0.5 (CVE-2020-8173)
      • +
    • Nextcloud Server < 17.0.7 (CVE-2020-8173)
      • + +
    +

    Action Taken

    +

    The error has been fixed.

    +

    Resolution

    +

    It is recommended that the Nextcloud Server is upgraded to 19.0.0.

    +

    Acknowledgements

    +

    The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:

    +
      +
    • Lynn Stephenson - Vulnerability discovery and disclosure.
      • +
    +
    + This advisory is licensed CC BY-SA 4.0. +
    +
    diff --git a/advisories/nc-sa-2020-025.php b/advisories/nc-sa-2020-025.php index 668ed7e7..5b0b5fa6 100644 --- a/advisories/nc-sa-2020-025.php +++ b/advisories/nc-sa-2020-025.php @@ -26,7 +26,7 @@

    Acknowledgements

    The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:


    This advisory is licensed CC BY-SA 4.0. diff --git a/advisories/nc-sa-2020-026.php b/advisories/nc-sa-2020-026.php new file mode 100644 index 00000000..bff9040e --- /dev/null +++ b/advisories/nc-sa-2020-026.php @@ -0,0 +1,35 @@ +
    +
    +

    Security Advisory

    + Back to advisories +
    +
    +
    +
    +

    Password of share by mail is not hashed when given on the create share call (NC-SA-2020-026)

    +

    4th June 2020

    +

    Risk level: Low

    +

    CVSS v3 Base Score: 5 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

    +

    CWE: Plaintext Storage of a Password (CWE-256)

    +

    HackerOne report: 885041

    +

    Description

    +

    A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

    +

    Affected Software

    +
      +
    • Nextcloud Server < 19.0.1 (CVE-2020-8183)
      • +
    • Nextcloud Server < 18.0.6 (CVE-2020-8183)
      • + +
    +

    Action Taken

    +

    The error has been fixed.

    +

    Resolution

    +

    It is recommended that the Nextcloud Server is upgraded to 19.0.1.

    +

    Acknowledgements

    +

    The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:

    + +
    + This advisory is licensed CC BY-SA 4.0. +
    +
    diff --git a/advisories/nc-sa-2020-028.php b/advisories/nc-sa-2020-028.php new file mode 100644 index 00000000..2b5def57 --- /dev/null +++ b/advisories/nc-sa-2020-028.php @@ -0,0 +1,34 @@ +
    +
    +

    Security Advisory

    + Back to advisories +
    +
    +
    +
    +

    Possible denial of service when entering a long password (NC-SA-2020-028)

    +

    16th June 2020

    +

    Risk level: Low

    +

    CVSS v3 Base Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

    +

    CWE: Brute Force (CWE-307)

    +

    HackerOne report: 840598

    +

    Description

    +

    Improper check of inputs in Preferred providers app 1.6.0 allowed to perform a denial of service attack when using a very long password.

    +

    Affected Software

    +
      +
    • Nextcloud Preferred_providers < 1.7.0 (CVE-2020-8202)
      • + +
    +

    Action Taken

    +

    The error has been fixed.

    +

    Resolution

    +

    It is recommended that the Preferred providers app is upgraded to 1.7.0.

    +

    Acknowledgements

    +

    The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory:

    +
      +
    • Abhishek Raj (araj07810@gmail.com) - Vulnerability discovery and disclosure.
      • +
    +
    + This advisory is licensed CC BY-SA 4.0. +
    +
    -- cgit v1.2.3