CVE-2021-22879

Name	CVE-2021-22879
Description	Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	987274

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nextcloud-desktop (PTS)	bullseye	3.1.1-2+deb11u1	fixed
	bullseye (security)	3.1.1-2+deb11u2	fixed
	bookworm	3.7.3-1+deb12u2	fixed
	trixie	3.16.7-1~deb13u1	fixed
	forky, sid	4.0.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nextcloud-desktop	source	(unstable)	3.1.1-2			987274

Notes

[buster] - nextcloud-desktop <no-dsa> (Minor issue)
https://nextcloud.com/security/advisory/?id=NC-SA-2021-008
https://github.com/nextcloud/desktop/pull/2906