ALT-PU-2023-7785: package nextcloud update to version 26.0.9-alt0.p10.1
Описание
This update upgrades nextcloud to version 26.0.9-alt0.p10.1.
Устраненные уязвимости49
Связанные уязвимости
ALT-PU-2023-2009: package `nextcloud` update to version 27.0.0-alt1
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
Nextcloud server provides a home for data. A regression in the session ...
Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неверным сроком действия сеанса, позволяющая нарушителю перехватить сеанс пользователя
Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.