First Last Prev Next    This bug is not in your last search results.
Bug 1162784 - (CVE-2019-15621) VUL-1: CVE-2019-15621: nextcloud: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link
(CVE-2019-15621)
VUL-1: CVE-2019-15621: nextcloud: Improper permissions preservation causes sh...
Status: RESOLVED FIXED
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.1
Other Other
: P4 - Low : Minor (vote)
: ---
Assigned To: Eric Schirra
Security Team bot
https://smash.suse.de/issue/252412/
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2020-02-05 09:42 UTC by Robert Frohl
Modified: 2020-03-23 07:51 UTC (History)
0 users

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-02-05 09:42:06 UTC 
CVE-2019-15621

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to
be able to reshare with write permissions when sharing the mount point of a
share they received, as a public link.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15621
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15621
https://nextcloud.com/security/advisory/?id=NC-SA-2020-012
https://hackerone.com/reports/619484
Comment 1 Robert Frohl 2020-02-05 09:42:26 UTC 
not yet fixed in Leap 15.1 and 15.2
Comment 2 Eric Schirra 2020-02-06 11:18:40 UTC 
What have this todo with Leap?
Leap have another branch.
Comment 3 Robert Frohl 2020-02-06 12:36:31 UTC 
(In reply to Eric Schirra from comment #2)
> What have this todo with Leap?
> Leap have another branch.

advisory states affected software: 
Nextcloud Server < 16.0.2
Nextcloud Server < 15.0.9
Nextcloud Server < 14.0.13

Leap is on 15.0.7.
Comment 4 Swamp Workflow Management 2020-02-06 19:40:23 UTC 
This is an autogenerated message for OBS integration:
This bug (1162784) was mentioned in
https://build.opensuse.org/request/show/770689 15.1 / nextcloud
https://build.opensuse.org/request/show/770691 Backports:SLE-15-SP1 / nextcloud
Comment 5 Swamp Workflow Management 2020-02-15 23:11:34 UTC 
openSUSE-SU-2020:0220-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1162766,1162775,1162776,1162781,1162782,1162784
CVE References: CVE-2019-15613,CVE-2019-15621,CVE-2019-15623,CVE-2019-15624,CVE-2020-8118,CVE-2020-8119
Sources used:
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    nextcloud-13.0.12-19.1
Comment 6 Swamp Workflow Management 2020-02-15 23:13:25 UTC 
openSUSE-SU-2020:0220-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1162766,1162775,1162776,1162781,1162782,1162784
CVE References: CVE-2019-15613,CVE-2019-15621,CVE-2019-15623,CVE-2019-15624,CVE-2020-8118,CVE-2020-8119
Sources used:
openSUSE Leap 15.1 (src):    nextcloud-15.0.14-lp151.2.3.1
openSUSE Backports SLE-15-SP1 (src):    nextcloud-15.0.14-bp151.3.3.1
openSUSE Backports SLE-15 (src):    nextcloud-13.0.12-bp150.19.1
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    nextcloud-13.0.12-19.1
Comment 7 Swamp Workflow Management 2020-02-17 17:15:23 UTC 
openSUSE-SU-2020:0229-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1162766,1162775,1162776,1162781,1162782,1162784
CVE References: CVE-2019-15613,CVE-2019-15621,CVE-2019-15623,CVE-2019-15624,CVE-2020-8118,CVE-2020-8119
Sources used:
openSUSE Backports SLE-15-SP1 (src):    nextcloud-15.0.14-bp151.3.6.1
Comment 8 Eric Schirra 2020-03-23 07:51:09 UTC 
Leap is now 15.0.14.
Think we can close it.
First Last Prev Next    This bug is not in your last search results.