git: 9af715c7184c - main - www/nextcloud-calendar: Document command injection vuln
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sun, 17 Apr 2022 12:09:58 UTC
The branch main has been updated by brnrd:
URL: https://cgit.FreeBSD.org/ports/commit/?id=9af715c7184c24aa0f2dbcce003eb5a37a3c12a6
commit 9af715c7184c24aa0f2dbcce003eb5a37a3c12a6
Author: Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2022-04-17 12:09:54 +0000
Commit: Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2022-04-17 12:09:54 +0000
www/nextcloud-calendar: Document command injection vuln
---
security/vuxml/vuln-2022.xml | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index 5fb27bdba36a..8c9ab69156a8 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,33 @@
+ <vuln vid="2a314635-be46-11ec-a06f-d4c9ef517024">
+ <topic>Nextcloud Calendar -- SMTP Command Injection</topic>
+ <affects>
+ <package>
+ <name>nextcloud-calendar</name>
+ <range><lt>3.2.2</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p> reports:</p>
+ <blockquote cite="https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf">
+ <p>SMTP Command Injection in Appointment Emails via Newlines: as newlines
+ and special characters are not sanitized in the email value in the JSON
+ request, a malicious attacker can inject newlines to break out of the
+ `RCPT TO:<BOOKING USER'S EMAIL>` SMTP command and begin injecting
+ arbitrary SMTP commands.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2022-24838</cvename>
+ <url>https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf</url>
+ </references>
+ <dates>
+ <discovery>2022-04-11</discovery>
+ <entry>2022-04-17</entry>
+ </dates>
+ </vuln>
+
<vuln vid="add683be-bd76-11ec-a06f-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>