Upstream information

CVE-2021-32741 at MITRE

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

SUSE information

Overall state of this security issue: Revisit

This issue is currently rated as having moderate severity.

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub for SUSE Linux Enterprise 12
  • nextcloud >= 20.0.11-28.1
  • nextcloud-apache >= 20.0.11-28.1
Patchnames:
openSUSE-2021-1068
SUSE Package Hub for SUSE Linux Enterprise 15 SP1
  • nextcloud >= 20.0.11-bp151.3.15.1
  • nextcloud-apache >= 20.0.11-bp151.3.15.1
Patchnames:
openSUSE-2021-1068
SUSE Package Hub for SUSE Linux Enterprise 15 SP2
  • nextcloud >= 20.0.11-bp152.2.9.1
  • nextcloud-apache >= 20.0.11-bp152.2.9.1
Patchnames:
openSUSE-2021-1068
SUSE Package Hub for SUSE Linux Enterprise 15 SP3
  • nextcloud >= 20.0.11-bp153.2.3.1
  • nextcloud-apache >= 20.0.11-bp153.2.3.1
Patchnames:
openSUSE-2021-1068
openSUSE Leap 15.2
  • nextcloud >= 20.0.11-lp152.3.9.1
  • nextcloud-apache >= 20.0.11-lp152.3.9.1
Patchnames:
openSUSE-2021-1068
openSUSE Leap 15.3
  • nextcloud >= 20.0.11-bp153.2.3.1
  • nextcloud-apache >= 20.0.11-bp153.2.3.1
Patchnames:
openSUSE-2021-1068