Описание
Security update for nextcloud
This update for nextcloud fixes security issues and bugs.
Security issues fixed:
- CVE-2018-3780: Stored XSS in autocomplete suggestions for file comments (boo#1114817)
This update also contains all bug fixes and improvements in the 13.0.8 version, including:
- Password expiration time changed from 12h to 7d
- Bug fixes to the OAuth brute force protection
- Various other bug fixes and improvements
Список пакетов
SUSE Package Hub for SUSE Linux Enterprise 12
nextcloud-13.0.8-bp150.2.6.1
SUSE Package Hub for SUSE Linux Enterprise 15
nextcloud-13.0.8-bp150.2.6.1
Ссылки
- E-Mail link for openSUSE-SU-2018:3999-1
- SUSE Security Ratings
Описание
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.
Затронутые продукты
SUSE Package Hub for SUSE Linux Enterprise 12:nextcloud-13.0.8-bp150.2.6.1
SUSE Package Hub for SUSE Linux Enterprise 15:nextcloud-13.0.8-bp150.2.6.1
Ссылки
- CVE-2018-3780
- SUSE Bug 1105598