2025-04-08
ALT-BU-2025-5241-1
Branch c10f2 update bulletin.
Closed vulnerabilities
Published: 2024-11-15
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2024-52522
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
References:
Closed bugs
rclone 1.61.1
Обновить rclone