CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

This update for nextcloud-desktop fixes the following issues:

nextcloud-desktop was updated to 3.8.0:

• Resize WebView widget once the loginpage rendered

• Feature/secure file drop

• Check German translation for wrong wording

• L10n: Correct word

• Fix displaying of file details button for local syncfileitem activities

• Improve config upgrade warning dialog

• Only accept folder setup page if overrideLocalDir is set

• Update CHANGELOG.

• Prevent ShareModel crash from accessing bad pointers

• Bugfix/init value for pointers

• Log to stdout when built in Debug config

• Clean up account creation and deletion code

• L10n: Added dot to end of sentence

• L10n: Fixed grammar

• Fix 'Create new folder' menu entries in settings not working correctly on macOS

• Ci/clang tidy checks init variables

• Fix share dialog infinite loading

• Fix edit locally job not finding the user account: wrong user id

• Skip e2e encrypted files with empty filename in metadata

• Use new connect syntax

• Fix avatars not showing up in settings dialog account actions until clicked on

• Always discover blacklisted folders to avoid data loss when modifying selectivesync list.

• Fix infinite loading in the share dialog when public link shares are disabled on the server

• With cfapi when dehydrating files add missing flag

• Fix text labels in Sync Status component

• Display 'Search globally' as the last sharees list element

• Fix display of 2FA notification.

• Bugfix/do not restore virtual files

• Show server name in tray main window

• Add Ubuntu Lunar

• Debian build classification 'beta' cannot override 'release'.

• Update changelog

• Follow shouldNotify flag to hide notifications when needed

• Bugfix/stop after creating config file

• E2EE cut extra zeroes from derypted byte array.

• When local sync folder is overriden, respect this choice

• Feature/e2ee fixes

• This also fix security issues:

  • (boo#1205798, CVE-2022-39331)
    • Arbitrary HyperText Markup Language injection in notifications
  • (boo#1205799, CVE-2022-39332)
    • Arbitrary HyperText Markup Language injection in user status and information
  • (boo#1205800, CVE-2022-39333)
    • Arbitrary HyperText Markup Language injection in desktop client application
  • (boo#1205801, CVE-2022-39334)
    • Client incorrectly trusts invalid TLS certificates
  • (boo#1207976, CVE-2023-23942)
    • missing sanitisation on qml labels leading to javascript injection

• Update to 3.7.4

  • check German translation for wrong wording
  • Fix 'Create new folder' menu entries in settings not working correctly on macOS
  • Clean up account creation and deletion code
  • Fix share dialog infinite loading
  • fix edit locally job not finding the user account: wrong user id
  • skip e2e encrypted files with empty filename in metadata
  • Always discover blacklisted folders to avoid data loss when modifying selectivesync list.
  • use new connect syntax
  • with cfapi when dehydrating files add missing flag
  • Fix avatars not showing up in settings dialog account actions until clicked on
  • Fix text labels in Sync Status component
  • Fix infinite loading in the share dialog when public link shares are disabled on the server
  • Ci/clang tidy checks init variables
  • Display 'Search globally' as the last sharees list element
  • Resize WebView widget once the loginpage rendered
  • Bugfix/do not restore virtual files
  • Fix display of 2FA notification.

• Update to 3.7.3

  • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
  • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'
  • Revert 'Fix(l10n): capital_abcd Update translations from Transifex'

• Update to 3.7.2

  • No regular changelog from upstream. See instead: https://github.com/nextcloud/desktop/compare/v3.7.1...v3.7.2

• Update to 3.7.1

  • Backport/5393/stable 3.7 by @mgallien in #5403
  • Fix wrong estimated time when doing sync. in…

This update for nextcloud-desktop fixes the following issues:

Update ot 3.8.0

• Resize WebView widget once the loginpage rendered

• Feature/secure file drop

• Check German translation for wrong wording

• L10n: Correct word

• Fix displaying of file details button for local syncfileitem activities

• Improve config upgrade warning dialog

• Only accept folder setup page if overrideLocalDir is set

• Update CHANGELOG.

• Prevent ShareModel crash from accessing bad pointers

• Bugfix/init value for pointers

• Log to stdout when built in Debug config

• Clean up account creation and deletion code

• L10n: Added dot to end of sentence

• L10n: Fixed grammar

• Fix 'Create new folder' menu entries in settings not working correctly on macOS

• Ci/clang tidy checks init variables

• Fix share dialog infinite loading

• Fix edit locally job not finding the user account: wrong user id

• Skip e2e encrypted files with empty filename in metadata

• Use new connect syntax

• Fix avatars not showing up in settings dialog account actions until clicked on

• Always discover blacklisted folders to avoid data loss when modifying selectivesync list.

• Fix infinite loading in the share dialog when public link shares are disabled on the server

• With cfapi when dehydrating files add missing flag

• Fix text labels in Sync Status component

• Display 'Search globally' as the last sharees list element

• Fix display of 2FA notification.

• Bugfix/do not restore virtual files

• Show server name in tray main window

• Add Ubuntu Lunar

• Debian build classification 'beta' cannot override 'release'.

• Update changelog

• Follow shouldNotify flag to hide notifications when needed

• Bugfix/stop after creating config file

• E2EE cut extra zeroes from derypted byte array.

• When local sync folder is overriden, respect this choice

• Feature/e2ee fixes

• This update also fixes security issues:

  • (boo#1205798, CVE-2022-39331)
    • Arbitrary HyperText Markup Language injection in notifications
  • (boo#1205799, CVE-2022-39332)
    • Arbitrary HyperText Markup Language injection in user status and information
  • (boo#1205800, CVE-2022-39333)
    • Arbitrary HyperText Markup Language injection in desktop client application
  • (boo#1205801, CVE-2022-39334)
    • Client incorrectly trusts invalid TLS certificates
  • (boo#1207976, CVE-2023-23942)
    • missing sanitisation on qml labels leading to javascript injection