[ GLSA 202107-14 ] rclone

[GLSA]

Gentoo Linux Security Advisory

Title: rclone: Weak random number generation (GLSA 202107-14)
Severity: normal
Exploitable: local
Date: 2021-07-08
Bug(s): #755638
ID: 202107-14

Synopsis

rclone uses weak random number generation such that generated
passwords can be easily cracked.


Background

rclone is a problem to sync files to and from various cloud storage
providers.


Affected Packages

Package: net-misc/rclone
Vulnerable: < 1.53.3
Unaffected: >= 1.53.3
Architectures: All supported architectures


Description

Passwords generated with rclone were insecurely generated and are
vulnerable to brute force attacks.


Impact

Data kept secret with a password generated by rclone may be disclosed to
a local attacker.


Workaround

There is no known workaround at this time.

Resolution

All rclone users should upgrade to the latest version: