Stay Secure with the Latest Linux Advisories

security advisorygentoocode execution

Gentoo: 202105-37 Normal: Nextcloud Desktop Client Remote Risk

A vulnerability in Nextcloud Desktop Client could allow a remote attacker to execute arbitrary commands.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202105-37 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Nextcloud Desktop Client: User-assisted execution of arbitrary code Date: May 26, 2021 Bugs: #783531 ID: 202105-37 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Nextcloud Desktop Client could allow a remote attacker to execute arbitrary commands. Background ========= The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/nextcloud-client < 3.1.3 > = 3.1.3 Description ========== It was discovered that Nextcloud Desktop Client did not validate URLs. Impact ===== A remote attacker could entice a user to connect to a malicious Nextcloud server to cause the execution of arbitrary commands with the privileges of the user running the Nextcloud Desktop Client application. Workaround ========= There is no known workaround at this time. Resolution ========= All Nextcloud Desktop Client users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v "> =net-misc/nextcloud-client-3.1.3" References ========= [ 1 ] CVE-2021-22879 https://nvd.nist.gov/vuln/detail/CVE-2021-22879 Availability =========== This GLSA and any updates to itare available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202105-37 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . The recent Nextcloud advisory GLSA 202105-38 highlights a moderate severity vulnerability that permits remote code execution.. Nextcloud Client,Gentoo Security Advisory,Remote Exploit,Nextcloud User Risk. . LinuxSecurity.com Team

May 26, 2021 Gentoo