Fixes for CVE-2020-8259/CVE-2020-8152 in Nextcloud 18/19

ℹ️ Support
, ,
1

NC-SA-2020-041 / CVE-2020-8259 and NC-SA-2020-04 / CVE-2020-8152 were reported against 19.0.1 a couple of months ago. The advisory states that they’re fixed in 20.0.0+, but it seems the fix hasn’t been backported to NC18/19 (yet?).

Does anyone know what the status of these CVEs is in NC19 and NC18?

2

@jospoortvliet Can you please answer this question.

3

Resolution

It is recommended that the Nextcloud Server is upgraded to 20.0.0.

The resolution (for any version) is to update to 20.0.0 or later

4

OK. Thanks for the clarification. Bit weird for a supported version to not receive security fixes, but I see from the related PR that the fix is non-trivial.

5

Hi,

Do you mean all supported version (except 20.0) won’t be fixed?

6

Exactly. Looking at the attack vector of the issue and the size/dimension of the fix, we agreed that it is acceptable to have “Update to 20” as a resolution.

1 Like
7

Thanks to answer quickly.
This attack affects only installation with encrypted files?