CVE-2022-39334: nextcloudcmd incorrectly trusts bad TLS certificates
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nextcloud-desktopto a version that resolves this vulnerability.Fixed in 3.7.3-1+deb12u2Fixed in 3.16.7-1~deb13u1Fixed in 35.0.0-1 - Upgrade
Upgrade
debian/nextcloud-desktopto a version that resolves this vulnerability.Fixed in 3.6.1-1 - Upgrade
Upgrade
nextcloudcmdto a version that resolves this vulnerability.Fixed in 3.6.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Nextcloud vulnerability?
The vulnerability ID for this Nextcloud vulnerability is CVE-2022-39334.
What is the severity of CVE-2022-39334?
The severity of CVE-2022-39334 is medium with a CVSS score of 4.7.
What can an attacker do with this vulnerability?
An attacker exploiting CVE-2022-39334 can perform a Man-in-the-Middle attack to expose sensitive data or credentials.
How does this vulnerability affect Nextcloud desktop versions?
Nextcloud desktop versions up to and excluding 3.6.1 are affected by CVE-2022-39334.
Are there any fixes or patches available for this vulnerability?
Yes, a fix is available in version 3.6.1 of nextcloudcmd utility.