CVE-2024-52521: Nextcloud Server has a potential hash collision for background jobs could skip queuing them
Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52521?
CVE-2024-52521 is considered a moderate severity vulnerability affecting Nextcloud Server installations.
How do I fix CVE-2024-52521?
To fix CVE-2024-52521, you should update your Nextcloud Server to version 28.0.11 or later, 29.0.8 or later, or 30.0.1 or later.
What versions of Nextcloud Server are affected by CVE-2024-52521?
CVE-2024-52521 affects Nextcloud Server versions prior to 28.0.11, 29.0.8, and 30.0.1.
What type of issue is CVE-2024-52521 related to?
CVE-2024-52521 is related to an inadequate hash function that can lead to background job collisions in Nextcloud Server.
Can exploiting CVE-2024-52521 affect the functionality of Nextcloud Server?
Yes, exploiting CVE-2024-52521 can cause background jobs to be falsely identified as existing, potentially impacting their execution.