Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/rclone/rclone: CVE-2024-52522 #3271

Closed
GoVulnBot opened this issue Nov 15, 2024 · 1 comment
Closed
Assignees
Labels

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-52522 references a vulnerability in the following Go modules:

Module
github.com/rclone/rclone

Description:
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/rclone/rclone
      vulnerable_at: 1.68.2
summary: CVE-2024-52522 in github.com/rclone/rclone
cves:
    - CVE-2024-52522
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52522
    - fix: https://github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0
    - web: https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv
source:
    id: CVE-2024-52522
    created: 2024-11-15T19:01:28.337842491Z
review_status: UNREVIEWED

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/629356 mentions this issue: data/reports: add 9 unreviewed reports

@tatianab tatianab self-assigned this Nov 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants