Please clarify CVE-2024-22403 of 18 January 2024

[solracsf]

About GHSA-wppc-f5g8-vx36

It is stated that:

It is recommended that the Nextcloud Server is upgraded to 28.0.0
It is recommended that the Nextcloud Enterprise Server is upgraded to 28.0.0

Does this mean that (supported) server versions 26 and 27 will remain unpatched?
(or, in other words, no backport of #40766 to server supported versions)?

Thanks.

[nickvergessen]

That is correct.

---

PS: For the next time (due to notification settings of the security team) please consider the note in the SA:

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories

[solracsf]

This has been backported, for the record: #43020

[bcutter]

This has been backported, for the record: #43020

Might this be the reason for this insane #43157 ?

[nickvergessen]

No, especially because someone has the same issue from 28.0.2rc1 to 28.0.2rc4, because 28 got there fix in 28.0.0 already

[bcutter]

@nickvergessen Hi Joas, okay so would you please have a look at #43157 even it is not related to this CVE?