Bug 2063275 (CVE-2022-24741)

Summary:	CVE-2022-24741 nextcloud: High memory usage for generating preview of broken image
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ce, james.hogarth
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-11 21:31:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2063276
Bug Blocks:

Description Patrick Del Bello 2022-03-11 17:07:23 UTC

Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8, 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.

Upstream fix:
https://github.com/nextcloud/server/pull/30291/commits/d3d65e5c889fc3922efc7a8c764027763bc4764f

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24741
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24741
https://github.com/nextcloud/server/pull/30291
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89
http://www.cvedetails.com/cve/CVE-2022-24741/
https://hackerone.com/reports/1261225

Comment 1 Patrick Del Bello 2022-03-11 17:07:37 UTC

Created nextcloud tracking bugs for this issue:

Affects: fedora-all [bug 2063276]

Comment 2 Product Security DevOps Team 2022-03-11 21:31:28 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.