CVE-2024-52522
Fixed in a distro release EPSS <1%CVSS 5.4
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
Products: rclone
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rclone/rclone | 1.68.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | rclone | 1.68.2-r0 |
| Chainguard | rclone-compat | 1.68.2-r0 |
| Chainguard | telegraf-1.32 | 1.32.3-r1 |
| Debian 12 | rclone | no fix |
| Debian 13 | rclone | no fix |
| Ubuntu 25.10 | rclone | no fix |
| Ubuntu 26.10 | rclone | no fix |
| Ubuntu Pro 24.04 LTS | rclone | no fix |
| Ubuntu Pro 26.04 LTS | rclone | no fix |
| Wolfi | rclone | 1.68.2-r0 |
| Wolfi | rclone-compat | 1.68.2-r0 |
| Wolfi | telegraf-1.32 | 1.32.3-r1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241119T173509-1.1 |
| openSUSE Tumbleweed | rclone | 1.68.2-2.1 |