openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0220-1 Rating: moderate References: #1162766 #1162775 #1162776 #1162781 #1162782 #1162784 Cross-References: CVE-2019-15613 CVE-2019-15621 CVE-2019-15623 CVE-2019-15624 CVE-2020-8118 CVE-2020-8119 Affected Products: openSUSE Leap 15.1 openSUSE Backports SLE-15-SP1 openSUSE Backports SLE-15 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: Nextcloud was updated to 15.0.14: - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766) - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775) - NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776) - NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781) - NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782) - NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784) - To many changes. For detail see: https://nextcloud.com/changelog/ nextcloud was updated to 13.0.12: - Fix NC-SA-2020-001 - To many changes. For detail see: https://nextcloud.com/changelog/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-220=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2020-220=1 - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2020-220=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2020-220=1 Package List: - openSUSE Leap 15.1 (noarch): nextcloud-15.0.14-lp151.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): nextcloud-15.0.14-bp151.3.3.1 - openSUSE Backports SLE-15 (noarch): nextcloud-13.0.12-bp150.19.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-13.0.12-19.1 References: https://www.suse.com/security/cve/CVE-2019-15613.html https://www.suse.com/security/cve/CVE-2019-15621.html https://www.suse.com/security/cve/CVE-2019-15623.html https://www.suse.com/security/cve/CVE-2019-15624.html https://www.suse.com/security/cve/CVE-2020-8118.html https://www.suse.com/security/cve/CVE-2020-8119.html https://bugzilla.suse.com/1162766 https://bugzilla.suse.com/1162775 https://bugzilla.suse.com/1162776 https://bugzilla.suse.com/1162781 https://bugzilla.suse.com/1162782 https://bugzilla.suse.com/1162784