Skip to content
OpenAdvisories
High · 8.1 CVE-2021-41177 EUVD-2021-28279

Rate-limits not working on instances without configured memory cache backend

Published Oct 25, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`.

Affected products

VendorProductAffectedFixed
nextcloud security-advisories < 20.0.13, >= 21.0.0, < 21.0.5, < 22.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1
SUSE Package Hub 15 SP2 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1
SUSE Package Hub 15 SP1 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1
openSUSE Leap 15.2 nextcloud 20.0.14-bp153.2.9.1 openSUSE-SU-2021:1602-1

Advisories 1

References