Security update for nextcloud (moderate)

An update that fixes 6 vulnerabilities is now available.

Description:

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

• NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour
  on the file extension when checking file mimetypes (boo#1162766)
• NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused
  the server to send it’s domain and user IDs to the Nextcloud Lookup
  Server without any further data when the Lookup server is disabled
  (boo#1162775)
• NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group
  admins to create users with IDs of system folders (boo#1162776)
• NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of
  previews and files when a file-drop share link is opened via the gallery
  app (boo#1162781)
• NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request
  forgery allowed to detect local and remote services when adding a new
  subscription in the calendar application (boo#1162782)
• NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes
  sharees to be able to reshare with write permissions when sharing the
  mount point of a share they received, as a public link (boo#1162784)
• To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

• Fix NC-SA-2020-001
• To many changes. For detail see: https://nextcloud.com/changelog/

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.1:

  zypper in -t patch openSUSE-2020-220=1

• openSUSE Backports SLE-15-SP1:

  zypper in -t patch openSUSE-2020-220=1

• openSUSE Backports SLE-15:

  zypper in -t patch openSUSE-2020-220=1

• SUSE Package Hub for SUSE Linux Enterprise 12:

  zypper in -t patch openSUSE-2020-220=1