Source: nextcloud-desktop X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security
Hi, The following vulnerability was published for nextcloud-desktop. CVE-2023-28999[0]: | Nextcloud is an open-source productivity platform. In Nextcloud | Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until | 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server | administrator can gain full access to an end-to-end encrypted folder. | They can decrypt files, recover the folder structure and add new | files.​ This issue is fixed in Nextcloud Desktop 3.8.0, | Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known | workarounds are available. https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8875-wxww-3rr8 https://github.com/nextcloud/desktop/pull/5560 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-28999 https://www.cve.org/CVERecord?id=CVE-2023-28999 Please adjust the affected versions in the BTS as needed.
