-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2021-eac0e52f88 2021-07-09 01:00:53.185856 --------------------------------------------------------------------------------
Name : nextcloud Product : Fedora 34 Version : 20.0.10 Release : 1.fc34 URL : http://nextcloud.com Summary : Private file sync and share server Description : NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing right on the web. NextCloud is extendable via a simple but powerful API for applications and plugins.
-------------------------------------------------------------------------------- Update Information:
- Update to 20.0.10, fixes multiple CVEs (RHBZ 1934830, RHBZ 1934838, RHBZ 1934840, RHBZ 1977202) - Include php-fpm config in httpd subpackage - Set php memory limit to 512MB (RHBZ 1933529) - Add Referrer-policy no-referrer to nginx config (RHBZ 1933530) -------------------------------------------------------------------------------- ChangeLog:
* Wed Jun 30 2021 Christopher Engelhard ce@lcts.de - 20.0.10-1 - Update to 20.0.10, fixes multiple CVEs (RHBZ 1934830, RHBZ 1934838, RHBZ 1934840, RHBZ 1977202) - Include php-fpm config in httpd subpackage - Set php memory limit to 512MB (RHBZ 1933529) - Add Referrer-policy no-referrer to nginx config (RHBZ 1933530) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1933529 - The PHP memory limit is below the recommended value of 512MB https://bugzilla.redhat.com/show_bug.cgi?id=1933529 [ 2 ] Bug #1933530 - The ���Referrer-Policy��� HTTP header is not set to ���no-referrer���, ���no-referrer-when-downgrade���, ���strict-origin���, ���strict-origin-when-cross-origin��� or ���same-origin��� https://bugzilla.redhat.com/show_bug.cgi?id=1933530 [ 3 ] Bug #1934830 - CVE-2020-8296 nextcloud: Passwords stored in a recoverable format [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1934830 [ 4 ] Bug #1934838 - CVE-2021-22878 nextcloud: Reflected cross-site scripting due to lack of sanitization in `OC.Notification.show` [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1934838 [ 5 ] Bug #1934840 - CVE-2021-22877 nextcloud: Stored credentials accessible by other users [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1934840 [ 6 ] Bug #1977202 - CVE-2021-22915 nextcloud: lack of inclusion of IPv6 subnets in rate-limiting considerations allows brute force attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1977202 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-eac0e52f88' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------