CVE-2021-32728
Fixed in a distro release EPSS <1%CVSS 6.5
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0. There are no known workarounds aside from upgrading.
Products: nextcloud security-advisories
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | nextcloud-desktop | 2.5.1-3+deb10u2 |
| Debian 11 | nextcloud-desktop | 3.1.1-2+deb11u1 |
| Debian 12 | nextcloud-desktop | 3.3.1-1 |
| Debian 13 | nextcloud-desktop | 3.3.1-1 |
| Debian 14 | nextcloud-desktop | 3.3.1-1 |
| Ubuntu 20.04 LTS | nextcloud-desktop | no fix |
| Ubuntu 22.04 LTS | nextcloud-desktop | no fix |