Bug 1180929 – VUL-0: CVE-2020-8225: nextcloud-desktop: cleartext storage of sensitive information

Bug 1180929 - (CVE-2020-8225) VUL-0: CVE-2020-8225: nextcloud-desktop: cleartext storage of sensitive information

(CVE-2020-8225)
Summary:	VUL-0: CVE-2020-8225: nextcloud-desktop: cleartext storage of sensitive infor...

Status:	RESOLVED FIXED

Classification:	openSUSE
Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Security
Version:	Leap 15.2
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal (vote)
Target Milestone:	---
Assigned To:	Eric Schirra
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/267936/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-01-14 12:49 UTC by Alexandros Toptsoglou
Modified:	2021-02-28 18:48 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexandros Toptsoglou 2021-01-14 12:49:12 UTC

CVE-2020-8225

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.

References:

https://hackerone.com/reports/685990
https://nextcloud.com/security/advisory/?id=NC-SA-2020-031

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1914205
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8225
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-8225.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8225
https://hackerone.com/reports/685990
https://nextcloud.com/security/advisory/?id=NC-SA-2020-031

Comment 1 Eric Schirra 2021-02-15 15:58:21 UTC

Request for updates are done.

Comment 2 OBSbugzilla Bot 2021-02-15 16:30:12 UTC

This is an autogenerated message for OBS integration:
This bug (1180929) was mentioned in
https://build.opensuse.org/request/show/872585 15.2 / nextcloud-desktop
https://build.opensuse.org/request/show/872587 Backports:SLE-15-SP2 / nextcloud-desktop

Comment 3 Eric Schirra 2021-02-28 18:48:15 UTC

3.1.2 now in tepis so mit think it can close.