Desktop client does not verify received singed certificate in end-to-end encryption

Description

Impact

By trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker.

Patches

It is recommended that the Nextcloud Desktop client is upgraded to 3.7.0

Workarounds

• No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com