ALT-BU-2024-7335-1
Branch sisyphus_e2k update bulletin.
Package gnuplot updated to version 6.0.0-alt2 for branch sisyphus_e2k.
Closed bugs
Вышла версия 6.0
Package nextcloud updated to version 28.0.5-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2024-00723
Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неверным сроком действия сеанса, позволяющая нарушителю обойти процесс аутентификации
Modified: 2024-11-21
CVE-2024-22403
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36
- https://github.com/nextcloud/server/pull/40766
- https://github.com/nextcloud/server/pull/40766
- https://hackerone.com/reports/1784162
- https://hackerone.com/reports/1784162
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6WSG4X3ZA3AMPBEKNAX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6WSG4X3ZA3AMPBEKNAX/