CVE-2021-32705

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

This update for nextcloud fixes the following issues:

nextcloud was updated to 20.0.11:

• Fix boo#1188247 - CVE-2021-32678: OCS API response ratelimits are not applied
• Fix boo#1188248 - CVE-2021-32679: filenames where not escaped by default in controllers using DownloadResponse
• Fix boo#1188249 - CVE-2021-32680: share expiration date wasn't properly logged
• Fix boo#1188250 - CVE-2021-32688: lacking permission check with application specific tokens
• Fix boo#1188251 - CVE-2021-32703: lack of ratelimiting on the shareinfo endpoint
• Fix boo#1188252 - CVE-2021-32705: lack of ratelimiting on the public DAV endpoint
• Fix boo#1188253 - CVE-2021-32725: default share permissions were not being respected for federated reshares of files and folders
• Fix boo#1188254 - CVE-2021-32726: webauthn tokens were not deleted after a user has been deleted
• Fix boo#1188255 - CVE-2021-32734: possible full path disclosure on shared files
• Fix boo#1188256 - CVE-2021-32741: lack of ratelimiting on the public share link mount endpoint
• Bump handlebars from 4.7.6 to 4.7.7 (server#26900)
• Bump lodash from 4.17.20 to 4.17.21 (server#26909)
• Bump hosted-git-info from 2.8.8 to 2.8.9 (server#26920)
• Don't break OCC if an app is breaking in it's Application class (server#26954)
• Add bruteforce protection to the shareinfo endpoint (server#26956)
• Ignore readonly flag for directories (server#26965)
• Throttle MountPublicLinkController when share is not found (server#26971)
• Respect default share permissions for federated reshares (server#27001)
• Harden apptoken check (server#27014)
• Use parent wrapper to properly handle moves on the same source/target storage (server#27016)
• Fix error when using CORS with no auth credentials (server#27027)
• Fix return value of getStorageInfo when 'quota_include_external_storage' is enabled (server#27108)
• Bump patch dependencies (server#27183)
• Use noreply@ as email address for share emails (server#27209)
• Bump p-queue from 6.6.1 to 6.6.2 (server#27226)
• Bump browserslist from 4.14.0 to 4.16.6 (server#27247)
• Bump webpack from 4.44.1 to 4.44.2 (server#27297)
• Properly use limit and offset for search in Jail wrapper (server#27308)
• Make user:report command scale (server#27319)
• Properly log expiration date removal in audit log (server#27325)
• Propagate throttling on OCS response (server#27337)
• Set umask before operations that create local files (server#27349)
• Escape filename in Content-Disposition (server#27360)
• Don't update statuses to offline again and again (server#27412)
• Header must contain a colon (server#27456)
• Activate constraint check for oracle / pqsql also for 20 (server#27523)
• Only allow removing existing shares that would not be allowed due to reshare restrictions (server#27552)
• Bump ws from 7.3.1 to 7.5.0 (server#27570)
• Properly cleanup entries of WebAuthn on user deletion (server#27596)
• Throttle on public DAV endpoint (server#27617)
• Bump vue-loader from 15.9.3 to 15.9.7 (server#27639)
• Bump eslint-plugin-standard from 4.0.1 to 4.0.2 (server#27651)
• Validate the theming color also on CLI (server#27680)
• Downstream encryption:fix-encrypted-version for repairing bad signature errors (server#27728)
• Remove encodeURI code (files_pdfviewer#396)
• Only ask for permissions on HTTPS (notifications#998)
• Fix sorting if one of the file name is only composed with number (photos#785)
• Backport 20 fix Photos not shown in large browser windows #630 (#686) (photos#810)
• Update File.vue (photos#813)
• Update chart.js (serverinfo#309)
• Only return workspace property for top node in a propfind request (text#1611)
• ViewerComponent: pass on autofocus to EditorWrapper (text#1647)
• Use text/plain as content type for fetching the document (text#1692)
• Log exceptions that happen on unknown exception and return generic messages (text#1698)
• Add fixup (viewer#924)
• Fix: fullscreen for Firefox (viewer#929)

Update to 20.0.7

• Catch NotFoundException when querying quota…