Bugzilla – Bug 1205801
VUL-0: CVE-2022-39334: nextcloud-desktop: Client incorrectly trusts invalid TLS certificates
Last modified: 2023-07-10 16:14:22 UTC
CVE-2022-39334 Nextcloud desktop is the desktop sync client for Nextcloud. Versions prior to 3.6.1 would incorrectly trust invalid TLS certificates. A Man-in-the-middle attack is possible in case a user can be made running a nextcloudcmd CLI command locally. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39334 https://www.cve.org/CVERecord?id=CVE-2022-39334 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-82xx-98xv-4jxv http://www.cvedetails.com/cve/CVE-2022-39334/ https://github.com/nextcloud/desktop/pull/5022 https://github.com/nextcloud/desktop/issues/4927 https://hackerone.com/reports/1699740
Affected: - openSUSE:Backports:SLE-15-SP3/nextcloud-desktop 3.1.3 - openSUSE:Backports:SLE-15-SP4/nextcloud-desktop 3.3.6 Not Affected: - openSUSE:Factory/nextcloud-desktop 3.6.2
This is an autogenerated message for OBS integration: This bug (1205801) was mentioned in https://build.opensuse.org/request/show/1076605 Backports:SLE-15-SP4 / nextcloud-desktop
openSUSE-SU-2023:0090-1: An update that solves 5 vulnerabilities and has one errata is now available.\n\nCategory: security (important)\nBug References: 1201070,1205798,1205799,1205800,1205801,1207976\nCVE References: CVE-2022-39331,CVE-2022-39332,CVE-2022-39333,CVE-2022-39334,CVE-2023-23942\nJIRA References: \nSources used:\nopenSUSE Backports SLE-15-SP4 (src): nextcloud-desktop-3.8.0-bp154.2.3.1\n\n
done
fro bug 1213080, update missing in 15.5
submitted the 15.4 update to 15.5. Eric please approve the maintenance request review when it gets to you, and assign the bugs back to security-team@suse.de for processing.
This is an autogenerated message for OBS integration: This bug (1205801) was mentioned in https://build.opensuse.org/request/show/1097432 Backports:SLE-15-SP5 / nextcloud-desktop
Picking a random project maintainer. Please review https://build.opensuse.org/request/show/1097432 This puts the 15.4 package into 15.5. Then assign to security-team@suse.de The package has a bugowner @ecsos who is not maintainer. This is not consistent. See SR#1097478 for the permission. (same problem as the "state maintainer" problem) The distro has no structured mechanism to detect missed updates. You should fix this.
openSUSE-SU-2023:0171-1: An update that fixes 5 vulnerabilities is now available.\n\nCategory: security (important)\nBug References: 1205798,1205799,1205800,1205801,1207976\nCVE References: CVE-2022-39331,CVE-2022-39332,CVE-2022-39333,CVE-2022-39334,CVE-2023-23942\nJIRA References: \nSources used:\nopenSUSE Backports SLE-15-SP5 (src): nextcloud-desktop-3.8.0-bp155.2.3.1\n\n
Done for 15.5 now too, closing