CVE-2021-22895
First published: Fri Jun 11 2021(Updated: )
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/nextcloud-desktop | 2.5.1-3+deb10u2 3.1.1-2+deb11u1 3.7.3-1 3.10.0-1 | |
| Nextcloud Desktop | <3.1.3 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpgp-vf4p-wcw5
- https://github.com/nextcloud/desktop/commit/b1ddd0e491b2af0ed040e658d8bcde2a7a61c9fc
- https://salsa.debian.org/owncloud-team/nextcloud-desktop/-/commit/458555f9224196826dfc0903f58d964f081ad573
- https://security-tracker.debian.org/tracker/CVE-2021-22895
- https://bugs.debian.org/989846
- https://security-tracker.debian.org/tracker/CVE-2021-32728
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989846
- https://github.com/nextcloud/desktop/pull/2926
- https://github.com/nextcloud/desktop/releases/tag/v3.1.3
- https://hackerone.com/reports/903424
- https://www.debian.org/security/2021/dsa-4974
Frequently Asked Questions
What is CVE-2021-22895?
CVE-2021-22895 is a vulnerability in the Nextcloud Desktop Client that allows improper certificate validation.
How does CVE-2021-22895 affect Nextcloud Desktop Client?
CVE-2021-22895 affects Nextcloud Desktop Client versions before 3.3.1.
What is the severity of CVE-2021-22895?
The severity of CVE-2021-22895 is high with a CVSS score of 5.9.
How can I fix CVE-2021-22895?
To fix CVE-2021-22895, update Nextcloud Desktop Client to version 3.3.1 or later.
Where can I find more information about CVE-2021-22895?
You can find more information about CVE-2021-22895 on the Nextcloud Desktop Client GitHub page and the Nextcloud security advisories website.
- collector/debian-bugs
- alias/CVE-2021-22895
- collector/security-tracker-debian
- collector/nvd-index
- package-manager/debian
- vendor/nextcloud
- canonical/nextcloud desktop
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0