Description
Advisory CVE-2024-52522 references a vulnerability in the following Go modules:
| Module |
|---|
| github.com/rclone/rclone |
Description:
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
References:
- ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-52522
- FIX: rclone/rclone@01ccf20
- WEB: GHSA-hrxh-9w67-g4cv
Cross references:
- github.com/rclone/rclone appears in 1 other report(s):
- data/reports/GO-2022-0878.yaml (x/vulndb: potential Go vuln in github.com/rclone/rclone: GHSA-rmw5-xpg9-jr29 #878)
See doc/quickstart.md for instructions on how to triage this report.
id: GO-ID-PENDING
modules:
- module: github.com/rclone/rclone
vulnerable_at: 1.68.2
summary: CVE-2024-52522 in github.com/rclone/rclone
cves:
- CVE-2024-52522
references:
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52522
- fix: https://github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0
- web: https://github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cv
source:
id: CVE-2024-52522
created: 2024-11-15T19:01:28.337842491Z
review_status: UNREVIEWED