Please clarify CVE-2024-22403 of 18 January 2024

[solracsf]

About GHSA-wppc-f5g8-vx36

It is stated that:

It is recommended that the Nextcloud Server is upgraded to 28.0.0
It is recommended that the Nextcloud Enterprise Server is upgraded to 28.0.0

Does this mean that (supported) server versions 26 and 27 will remain unpatched?
(or, in other words, no backport of nextcloud/server#40766 to server supported versions)?

Thanks.

[nickvergessen]

Does this mean that (supported) server versions 26 and 27 will remain unpatched?

Yes as per your issue in server.

[solracsf]

Thanks.
What is the reasoning behind leaving supported server versions unpatched? 🤔

[nickvergessen]

It's a hardening and we don't consider it important enough

[solracsf]

Ok got it.

[solracsf]

This has been backported, for the record: nextcloud/server#43020