openSUSE Security Update: Security update for nextcloud
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:0229-1
Rating:             moderate
References:         #1162766 #1162775 #1162776 #1162781 #1162782 
                    #1162784 
Cross-References:   CVE-2019-15613 CVE-2019-15621 CVE-2019-15623
                    CVE-2019-15624 CVE-2020-8118 CVE-2020-8119
                   
Affected Products:
                    openSUSE Backports SLE-15-SP1
______________________________________________________________________________

   An update that fixes 6 vulnerabilities is now available.

Description:

   This update for nextcloud fixes the following issues:

   Nextcloud was updated to 15.0.14:

   - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour
     on the file extension when checking file mimetypes  (boo#1162766)
   - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused
     the server to send it's domain and user IDs to the Nextcloud Lookup
     Server without any further data when the Lookup server is disabled
     (boo#1162775)
   - NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group
     admins to create users with IDs of system folders (boo#1162776)
   - NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of
     previews and files when a file-drop share link is opened via the gallery
     app (boo#1162781)
   - NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request
     forgery allowed to detect local and remote services when adding a new
     subscription in the calendar application (boo#1162782)
   - NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes
     sharees to be able to reshare with write permissions when sharing the
     mount point of a share they received, as a public link (boo#1162784)
   - To many changes. For detail see: https://nextcloud.com/changelog/

   nextcloud was updated to 13.0.12:

   - Fix NC-SA-2020-001
   - To many changes. For detail see: https://nextcloud.com/changelog/


   This update was imported from the openSUSE:Leap:15.1:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP1:

      zypper in -t patch openSUSE-2020-229=1



Package List:

   - openSUSE Backports SLE-15-SP1 (noarch):

      nextcloud-15.0.14-bp151.3.6.1


References:

   https://www.suse.com/security/cve/CVE-2019-15613.html
   https://www.suse.com/security/cve/CVE-2019-15621.html
   https://www.suse.com/security/cve/CVE-2019-15623.html
   https://www.suse.com/security/cve/CVE-2019-15624.html
   https://www.suse.com/security/cve/CVE-2020-8118.html
   https://www.suse.com/security/cve/CVE-2020-8119.html
   https://bugzilla.suse.com/1162766
   https://bugzilla.suse.com/1162775
   https://bugzilla.suse.com/1162776
   https://bugzilla.suse.com/1162781
   https://bugzilla.suse.com/1162782
   https://bugzilla.suse.com/1162784

--