openSUSE-SU-2022:0089-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2022:0089-1

Upstream

Related

Published

2022-03-23T17:01:26Z

Modified

2025-05-07T18:13:15.913555Z

Summary

Security update for nextcloud

Details

This update for nextcloud fixes the following issues:

nextcloud was updated to 21.0.9:

CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905)
CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908)
CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952)
For more changes see https://nextcloud.com/changelog/#21-0-9

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

21.0.9-37.1

{
    "binaries": [
        {
            "nextcloud": "21.0.9-37.1",
            "nextcloud-apache": "21.0.9-37.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:0089-1.json"