Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

nextcloud-desktop: CVE-2023-28999

Related Vulnerabilities: CVE-2023-28999  

Source

Debian Bug report logs - #1034184
nextcloud-desktop: CVE-2023-28999

Package: src:nextcloud-desktop; Maintainer for src:nextcloud-desktop is ownCloud for Debian maintainers <pkg-owncloud-maintainers@lists.alioth.debian.org>;

Reported by: Moritz Mühlenhoff <jmm@inutil.org>

Date: Mon, 10 Apr 2023 17:45:03 UTC

Severity: important

Tags: security, upstream

Forwarded to https://github.com/nextcloud/desktop/pull/5560

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, ownCloud for Debian maintainers <pkg-owncloud-maintainers@lists.alioth.debian.org>:
Bug#1034184; Package src:nextcloud-desktop. (Mon, 10 Apr 2023 17:45:06 GMT) (full text, mbox, link).

Acknowledgement sent to Moritz Mühlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, ownCloud for Debian maintainers <pkg-owncloud-maintainers@lists.alioth.debian.org>. (Mon, 10 Apr 2023 17:45:06 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>
To: submit@bugs.debian.org
Subject: nextcloud-desktop: CVE-2023-28999
Date: Mon, 10 Apr 2023 19:41:54 +0200
Source: nextcloud-desktop
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for nextcloud-desktop.

CVE-2023-28999[0]:
| Nextcloud is an open-source productivity platform. In Nextcloud
| Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until
| 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server
| administrator can gain full access to an end-to-end encrypted folder.
| They can decrypt files, recover the folder structure and add new
| files.&amp;#8203; This issue is fixed in Nextcloud Desktop 3.8.0,
| Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known
| workarounds are available.

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8875-wxww-3rr8
https://github.com/nextcloud/desktop/pull/5560

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-28999
    https://www.cve.org/CVERecord?id=CVE-2023-28999

Please adjust the affected versions in the BTS as needed.

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Mon, 10 Apr 2023 18:54:09 GMT) (full text, mbox, link).

Set Bug forwarded-to-address to 'https://github.com/nextcloud/desktop/pull/5560'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Mon, 10 Apr 2023 18:54:09 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Tue Apr 11 13:11:48 2023; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started