关键信息 漏洞描述 标题: Potential hash collision for background jobs could skip queuing them 发布者: nickvergessen 漏洞编号: GHSA-2q6f-gjgj-7hp4 发布日期: 昨天 影响范围 受影响版本: - Nextcloud Server: >= 28.0.0, >= 29.0.0, >= 30.0.0 - Nextcloud Enterprise: >= 28.0.0, >= 29.0.0, >= 30.0.0 修复版本 已修复版本: - Nextcloud Server: 28.0.10, 29.0.7, 30.0.0 - Nextcloud Enterprise: 28.0.10, 29.0.7, 30.0.0 严重性 严重性: Low (2.6 / 10) 影响 描述: MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. 解决方案 建议: Upgrade to 28.0.10, 29.0.7, or 30.0.0 versions. 工作绕过 无工作绕过可用 引用 报告者: Bundesamt für Sicherheit in der Informationstechnik (BSI) Pull Request: Reported by BSI 更多信息 问题或评论: 在nextcloud/security-advisories创建一个帖子或联系portal.nextcloud.com打开支持票。 CVE ID CVE-2024-52521 弱点 CWE-328