CVE-2021-32727: End-to-end encryption device setup did not verify public key
First published: Mon Jul 12 2021(Updated: )
Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. As a workaround, do not add additional end-to-end encrypted devices to a user account.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud | <3.16.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Nextcloud Android Client vulnerability?
The vulnerability ID for this Nextcloud Android Client vulnerability is CVE-2021-32727.
What is the severity of CVE-2021-32727?
The severity of CVE-2021-32727 is high with a severity value of 7.5.
What is the affected software for CVE-2021-32727?
The affected software for CVE-2021-32727 is Nextcloud Android Client versions prior to 3.16.1.
How can I fix CVE-2021-32727?
To fix CVE-2021-32727, update Nextcloud Android Client to version 3.16.1 or later.
Where can I find more information about CVE-2021-32727?
You can find more information about CVE-2021-32727 in the Nextcloud Android Client GitHub repository and the Nextcloud security advisories.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/tags
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- vendor/nextcloud
- canonical/nextcloud nextcloud