ALT-BU-2022-5884-1
Branch sisyphus_mipsel update bulletin.
Package nextcloud updated to version 24.0.4-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2021-41233
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.
Modified: 2024-11-21
CVE-2021-41239
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrx
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g722-cm3h-8wrx
- https://github.com/nextcloud/server/issues/27122
- https://github.com/nextcloud/server/issues/27122
- https://github.com/nextcloud/server/pull/29260
- https://github.com/nextcloud/server/pull/29260
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2021-41241
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.
- https://github.com/nextcloud/groupfolders/issues/1692
- https://github.com/nextcloud/groupfolders/issues/1692
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94
- https://github.com/nextcloud/server/pull/29362
- https://github.com/nextcloud/server/pull/29362
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2022-24741
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89
- https://github.com/nextcloud/server/pull/30291
- https://github.com/nextcloud/server/pull/30291
- https://hackerone.com/reports/1261225
- https://hackerone.com/reports/1261225
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2022-24888
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp
- https://github.com/nextcloud/server/pull/29895
- https://github.com/nextcloud/server/pull/29895
- https://hackerone.com/reports/1402249
- https://hackerone.com/reports/1402249
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2022-24889
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6
- https://github.com/nextcloud/server/pull/30615
- https://github.com/nextcloud/server/pull/30615
- https://hackerone.com/reports/1403614
- https://hackerone.com/reports/1403614
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2022-29163
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.
- https://github.com/nextcloud/circles/pull/866
- https://github.com/nextcloud/circles/pull/866
- https://github.com/nextcloud/circles/pull/926
- https://github.com/nextcloud/circles/pull/926
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
- https://hackerone.com/reports/1406926
- https://hackerone.com/reports/1406926
Modified: 2024-11-21
CVE-2022-29243
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w
- https://github.com/nextcloud/server/pull/31658
- https://github.com/nextcloud/server/pull/31658
- https://hackerone.com/reports/1153138
- https://hackerone.com/reports/1153138
- GLSA-202208-17
- GLSA-202208-17
Modified: 2024-11-21
CVE-2022-31014
Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2
- https://github.com/nextcloud/server/pull/32428
- https://github.com/nextcloud/server/pull/32428
- https://hackerone.com/reports/1516377
- https://hackerone.com/reports/1516377
Modified: 2024-11-21
CVE-2022-31118
Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq
- https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018
- https://github.com/nextcloud/server/pull/32843/commits/6eb692da7fe73c899cb6a8d2aa045eddb1f14018
Modified: 2024-11-21
CVE-2022-31120
Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x
- https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655
- https://github.com/nextcloud/server/pull/31594/commits/1d8bf9a89c6856218802a1d365000a5831be8655
- https://portal.nextcloud.com/article/using-the-audit-log-44.html
- https://portal.nextcloud.com/article/using-the-audit-log-44.html
Modified: 2024-11-21
CVE-2022-36074
Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Modified: 2024-11-21
CVE-2022-39211
Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
- https://github.com/nextcloud/server/pull/32988
- https://github.com/nextcloud/server/pull/32988
- https://github.com/nextcloud/server/pull/33031
- https://github.com/nextcloud/server/pull/33031
Modified: 2024-11-21
CVE-2022-39346
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6
- https://github.com/nextcloud/server/pull/33052
- https://github.com/nextcloud/server/pull/33052
- https://hackerone.com/reports/1588562
- https://hackerone.com/reports/1588562
- FEDORA-2022-902df3b060
- FEDORA-2022-902df3b060
- FEDORA-2022-98c1d712b5
- FEDORA-2022-98c1d712b5
- FEDORA-2022-49b20342c0
- FEDORA-2022-49b20342c0
Package moodle updated to version 3.11.8-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-03176
Уязвимость виртуальной обучающей среды Moodle, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю проводить межсайтовые сценарные атаки
BDU:2022-03179
Уязвимость реализации конфигурации moodle/badges:configurecriteria виртуальной обучающей среды Moodle, позволяющая нарушителю выполнить произвольный SQL-код
BDU:2022-03182
Уязвимость реализации класса core_auth виртуальной обучающей среды Moodle, позволяющая нарушителю обойти ограничения безопасности
BDU:2022-03183
Уязвимость реализации класса core_user виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-03231
Уязвимость реализации класса core_search виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-04906
Уязвимость виртуальной обучающей среды moodle, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код и раскрыть защищаемую информацию
BDU:2022-04907
Уязвимость реализации функции автоматического входа в систему с мобильных устройств виртуальной обучающей среды Moodle, позволяющая нарушителю провести фишинговую атаку и раскрыть защищаемую информацию
BDU:2022-04908
Уязвимость модуля LTI виртуальной обучающей среды Moodle, позволяющая нарушителю проводить фишинговые атаки или раскрыть защищаемую информацию
BDU:2022-06403
Уязвимость виртуальной обучающей среды Moodle, связанная с неправильной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2022-06405
Уязвимость виртуальной обучающей среды Moodle, связанная с недостаточной проверкой входных данных, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2022-30596
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74204
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74204
- https://bugzilla.redhat.com/show_bug.cgi?id=2083583
- https://bugzilla.redhat.com/show_bug.cgi?id=2083583
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-89bfefbe48
- FEDORA-2022-89bfefbe48
- FEDORA-2022-530fdc5202
- FEDORA-2022-530fdc5202
- https://moodle.org/mod/forum/discuss.php?d=434578
- https://moodle.org/mod/forum/discuss.php?d=434578
Modified: 2024-11-21
CVE-2022-30597
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318
- https://bugzilla.redhat.com/show_bug.cgi?id=2083585
- https://bugzilla.redhat.com/show_bug.cgi?id=2083585
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-89bfefbe48
- FEDORA-2022-89bfefbe48
- FEDORA-2022-530fdc5202
- FEDORA-2022-530fdc5202
- https://moodle.org/mod/forum/discuss.php?d=434579
- https://moodle.org/mod/forum/discuss.php?d=434579
Modified: 2024-11-21
CVE-2022-30598
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71623
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71623
- https://bugzilla.redhat.com/show_bug.cgi?id=2083592
- https://bugzilla.redhat.com/show_bug.cgi?id=2083592
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-89bfefbe48
- FEDORA-2022-89bfefbe48
- FEDORA-2022-530fdc5202
- FEDORA-2022-530fdc5202
- https://moodle.org/mod/forum/discuss.php?d=434580
- https://moodle.org/mod/forum/discuss.php?d=434580
Modified: 2024-11-21
CVE-2022-30599
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333
- https://bugzilla.redhat.com/show_bug.cgi?id=2083610
- https://bugzilla.redhat.com/show_bug.cgi?id=2083610
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-89bfefbe48
- FEDORA-2022-89bfefbe48
- FEDORA-2022-530fdc5202
- FEDORA-2022-530fdc5202
- https://moodle.org/mod/forum/discuss.php?d=434581
- https://moodle.org/mod/forum/discuss.php?d=434581
Modified: 2024-11-21
CVE-2022-30600
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-73736
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-73736
- https://bugzilla.redhat.com/show_bug.cgi?id=2083613
- https://bugzilla.redhat.com/show_bug.cgi?id=2083613
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-bd4457bcc4
- FEDORA-2022-89bfefbe48
- FEDORA-2022-89bfefbe48
- FEDORA-2022-530fdc5202
- FEDORA-2022-530fdc5202
- https://moodle.org/mod/forum/discuss.php?d=434582
- https://moodle.org/mod/forum/discuss.php?d=434582
Modified: 2024-11-21
CVE-2022-35649
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75044
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75044
- https://bugzilla.redhat.com/show_bug.cgi?id=2106273
- https://bugzilla.redhat.com/show_bug.cgi?id=2106273
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-7e7ce7df2e
- FEDORA-2022-7e7ce7df2e
- https://moodle.org/mod/forum/discuss.php?d=436456
- https://moodle.org/mod/forum/discuss.php?d=436456
Modified: 2024-11-21
CVE-2022-35650
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72029
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72029
- https://bugzilla.redhat.com/show_bug.cgi?id=2106274
- https://bugzilla.redhat.com/show_bug.cgi?id=2106274
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-7e7ce7df2e
- FEDORA-2022-7e7ce7df2e
- https://moodle.org/mod/forum/discuss.php?d=436457
- https://moodle.org/mod/forum/discuss.php?d=436457
Modified: 2024-11-21
CVE-2022-35651
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71921
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71921
- https://bugzilla.redhat.com/show_bug.cgi?id=2106275
- https://bugzilla.redhat.com/show_bug.cgi?id=2106275
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-7e7ce7df2e
- FEDORA-2022-7e7ce7df2e
- https://moodle.org/mod/forum/discuss.php?d=436458
- https://moodle.org/mod/forum/discuss.php?d=436458
Modified: 2024-11-21
CVE-2022-35652
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72171
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72171
- https://bugzilla.redhat.com/show_bug.cgi?id=2106276
- https://bugzilla.redhat.com/show_bug.cgi?id=2106276
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-7e7ce7df2e
- FEDORA-2022-7e7ce7df2e
- https://moodle.org/mod/forum/discuss.php?d=436459
- https://moodle.org/mod/forum/discuss.php?d=436459
Modified: 2024-11-21
CVE-2022-35653
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299
- https://bugzilla.redhat.com/show_bug.cgi?id=2106277
- https://bugzilla.redhat.com/show_bug.cgi?id=2106277
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-81ce74b2dd
- FEDORA-2022-7e7ce7df2e
- FEDORA-2022-7e7ce7df2e
- https://moodle.org/mod/forum/discuss.php?d=436460
- https://moodle.org/mod/forum/discuss.php?d=436460
Package gimagereader updated to version 3.4.0-alt3 for branch sisyphus_mipsel.
Closed bugs
Некорректная работа со сканером МФУ Inc. f+ imaging M60ade