Upstream information

CVE-2021-32801 at MITRE

Description

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.

SUSE information

Overall state of this security issue: Revisit

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database
Base Score 5.5
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Access Vector Local
Access Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1190291 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub for SUSE Linux Enterprise 12
  • nextcloud >= 20.0.12-31.1
  • nextcloud-apache >= 20.0.12-31.1
Patchnames:
openSUSE-2021-1252
SUSE Package Hub for SUSE Linux Enterprise 15 SP1
  • nextcloud >= 20.0.12-bp151.3.18.1
  • nextcloud-apache >= 20.0.12-bp151.3.18.1
Patchnames:
openSUSE-2021-1250
SUSE Package Hub for SUSE Linux Enterprise 15 SP2
  • nextcloud >= 20.0.12-bp152.2.12.1
  • nextcloud-apache >= 20.0.12-bp152.2.12.1
Patchnames:
openSUSE-2021-1275
SUSE Package Hub for SUSE Linux Enterprise 15 SP3
  • nextcloud >= 20.0.12-bp153.2.6.1
  • nextcloud-apache >= 20.0.12-bp153.2.6.1
Patchnames:
openSUSE-2021-1255
openSUSE Leap 15.2
  • nextcloud >= 20.0.12-lp152.3.12.1
  • nextcloud-apache >= 20.0.12-lp152.3.12.1
Patchnames:
openSUSE-2021-1253
openSUSE Leap 15.3
  • nextcloud >= 20.0.12-bp153.2.6.1
  • nextcloud-apache >= 20.0.12-bp153.2.6.1
Patchnames:
openSUSE-2021-1255