CVE-2024-52521: Nextcloud Server has a potential hash collision for background jobs could skip queuing them
First published: Fri Nov 15 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <28.0.10<29.0.7<30.0.0 | |
| Nextcloud Server | >=28.0.0<28.0.10 | |
| Nextcloud Server | >=28.0.0<28.0.10 | |
| Nextcloud Server | >=29.0.0<29.0.7 | |
| Nextcloud Server | >=29.0.0<29.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52521?
CVE-2024-52521 is considered a moderate severity vulnerability affecting Nextcloud Server installations.
How do I fix CVE-2024-52521?
To fix CVE-2024-52521, you should update your Nextcloud Server to version 28.0.11 or later, 29.0.8 or later, or 30.0.1 or later.
What versions of Nextcloud Server are affected by CVE-2024-52521?
CVE-2024-52521 affects Nextcloud Server versions prior to 28.0.11, 29.0.8, and 30.0.1.
What type of issue is CVE-2024-52521 related to?
CVE-2024-52521 is related to an inadequate hash function that can lead to background job collisions in Nextcloud Server.
Can exploiting CVE-2024-52521 affect the functionality of Nextcloud Server?
Yes, exploiting CVE-2024-52521 can cause background jobs to be falsely identified as existing, potentially impacting their execution.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/28.0.0
- version/nextcloud server/29.0.0