Description
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nextcloud | security-advisories | >= 3.0.0, < 3.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nextcloud-desktop | 3.7.0-1 | — |
| Debian 13 | nextcloud-desktop | 3.7.0-1 | — |
| Debian 12 | nextcloud-desktop | 3.7.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nextcloud-desktop | No fix yet | — |
| Ubuntu 20.04 LTS | nextcloud-desktop | No fix yet | — |