Every CVE Search/ Get API key

CVE-2020-28924

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

7.5 HighFix available

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.38%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
CVE-2020-28924
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-331, CWE-338
Updated
2026-11-02
CVE List No score

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
CVE-2020-28924
Updated
2026-11-02
EUVDEUVD-2021-1401 No score

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
EUVD-2021-1401
Updated
2026-11-03
GitHub AdvisoriesGHSA-rmw5-xpg9-jr29 7.5

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
GHSA-rmw5-xpg9-jr29
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-331, CWE-338
Updated
2026-11-02
OSV 7.5

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
CVE-2020-28924
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-28924 7.5

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
DEBIAN-CVE-2020-28924
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-rmw5-xpg9-jr29 7.5

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
GHSA-rmw5-xpg9-jr29
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-331, CWE-338
Updated
2026-11-02
OSVJLSEC-2026-278 7.5

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
JLSEC-2026-278
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-28924 7.5

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
UBUNTU-CVE-2020-28924
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-rclone-2020-28924 No score

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

Record
BIT-rclone-2020-28924
Updated
2026-11-02
OSVGO-2022-0878 No score

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

Record
GO-2022-0878
Updated
2026-11-02
OSVopenSUSE-SU-2020:2008-1 No score

Security update for rclone

This update for rclone fixes the following issues:

rclone was updated to version 1.53.3:

  • Bug Fixes
    • Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood)
    • Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone
  • VFS
    • Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood)
  • Sharefile
    • Fix backend due to API swapping integers for strings (Nick Craig-Wood)

Update to 1.53.2:

  • Bug Fixes
    • accounting
      • Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood)
      • Stabilize display order of transfers on Windows (Nick Craig-Wood)
    • operations
      • Fix use of --suffix without --backup-dir (Nick Craig-Wood)
      • Fix spurious '--checksum is in use but the source and destination have no hashes in common' (Nick Craig-Wood)
    • build
      • Work around GitHub actions brew problem (Nick Craig-Wood)
      • Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood)
  • Mount
    • mount2: Fix the swapped UID / GID values (Russell Cattelan)
  • VFS
    • Detect and recover from a file being removed externally from the cache (Nick Craig-Wood)
    • Fix a deadlock vulnerability in downloaders.Close (Leo Luan)
    • Fix a race condition in retryFailedResets (Leo Luan)
    • Fix missed concurrency control between some item operations and reset (Leo Luan)
    • Add exponential backoff during ENOSPC retries (Leo Luan)
    • Add a missed update of used cache space (Leo Luan)
    • Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood)
  • Local
    • Fix sizes and syncing with --links option on Windows (Nick Craig-Wood)
  • Chunker
    • Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev)
    • Fix upload over crypt (Ivan Andreev)
  • Fichier
    • Increase maximum file size from 100GB to 300GB (gyutw)
  • Jottacloud
    • Remove clientSecret from config when upgrading to token based authentication (buengese)
    • Avoid double url escaping of device/mountpoint (albertony)
    • Remove DirMove workaround as it's not required anymore - also (buengese)
  • Mailru
    • Fix uploads after recent changes on server (Ivan Andreev)
    • Fix range requests after june changes on server (Ivan Andreev)
    • Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev)
  • Onedrive
    • Fix disk usage for sharepoint (Nick Craig-Wood)
  • S3
    • Add missing regions for AWS (Anagh Kumar Baranwal)
  • Seafile
    • Fix accessing libraries > 2GB on 32 bit systems (Muffin King)
  • SFTP
    • Always convert the checksum to lower case (buengese)
  • Union
    • Create root directories if none exist (Nick Craig-Wood)

Update to version 1.53.1:

  • Bug Fixes
    • accounting: Remove new line from end of --stats-one-line display
  • VFS
    • Fix spurious error 'vfs cache: failed to _ensure cache EOF'
    • Log an ERROR if we fail to set the file to be sparse
  • Local
    • Log an ERROR if we fail to set the file to be sparse
  • Drive
    • Re-adds special oauth help text
  • Opendrive
    • Do not retry 400 errors

Update to version 1.53.0

  • New Features
    • The VFS layer was heavily reworked for this release - see below for more details
    • Interactive mode -i/--interactive for destructive operations (fishbullet)
    • Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood)
    • Transfers are sorted by start time in the stats and progress output (Max Sum)
    • Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood)
    • Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood)
    • rclone check
      • Add reporting of filenames for same/missing/changed (Nick Craig-Wood)
      • Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood)
      • Make check do --checkers files concurrently (Nick Craig-Wood) +…
Record
openSUSE-SU-2020:2008-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2035-1 No score

Security update for rclone

This update for rclone fixes the following issues:

rclone was updated to version 1.53.3:

  • Bug Fixes

    • Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood)
    • Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone

  • VFS

    • Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood)

  • Sharefile

    • Fix backend due to API swapping integers for strings (Nick Craig-Wood)

Update to 1.53.2:

  • Bug Fixes

    • accounting

      • Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood)
      • Stabilize display order of transfers on Windows (Nick Craig-Wood)

    • operations

      • Fix use of --suffix without --backup-dir (Nick Craig-Wood)
      • Fix spurious '--checksum is in use but the source and destination have no hashes in common' (Nick Craig-Wood)

    • build

      • Work around GitHub actions brew problem (Nick Craig-Wood)
      • Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood)

  • Mount

    • mount2: Fix the swapped UID / GID values (Russell Cattelan)

  • VFS

    • Detect and recover from a file being removed externally from the cache (Nick Craig-Wood)
    • Fix a deadlock vulnerability in downloaders.Close (Leo Luan)
    • Fix a race condition in retryFailedResets (Leo Luan)
    • Fix missed concurrency control between some item operations and reset (Leo Luan)
    • Add exponential backoff during ENOSPC retries (Leo Luan)
    • Add a missed update of used cache space (Leo Luan)
    • Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood)

  • Local

    • Fix sizes and syncing with --links option on Windows (Nick Craig-Wood)

  • Chunker

    • Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev)
    • Fix upload over crypt (Ivan Andreev)

  • Fichier

    • Increase maximum file size from 100GB to 300GB (gyutw)

  • Jottacloud

    • Remove clientSecret from config when upgrading to token based authentication (buengese)
    • Avoid double url escaping of device/mountpoint (albertony)
    • Remove DirMove workaround as it's not required anymore - also (buengese)

  • Mailru

    • Fix uploads after recent changes on server (Ivan Andreev)
    • Fix range requests after june changes on server (Ivan Andreev)
    • Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev)

  • Onedrive

    • Fix disk usage for sharepoint (Nick Craig-Wood)

  • S3

    • Add missing regions for AWS (Anagh Kumar Baranwal)

  • Seafile

    • Fix accessing libraries > 2GB on 32 bit systems (Muffin King)

  • SFTP

    • Always convert the checksum to lower case (buengese)

  • Union

    • Create root directories if none exist (Nick Craig-Wood)

Update to version 1.53.1:

  • Bug Fixes

    • accounting: Remove new line from end of --stats-one-line display

  • VFS

    • Fix spurious error 'vfs cache: failed to _ensure cache EOF'
    • Log an ERROR if we fail to set the file to be sparse

  • Local

    • Log an ERROR if we fail to set the file to be sparse

  • Drive

    • Re-adds special oauth help text

  • Opendrive

    • Do not retry 400 errors

Update to version 1.53.0

  • New Features
    • The VFS layer was heavily reworked for this release - see below for more details
    • Interactive mode -i/--interactive for destructive operations (fishbullet)
    • Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood)
    • Transfers are sorted by start time in the stats and progress output (Max Sum)
    • Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood)
    • Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood)
    • rclone check
      • Add reporting of filenames for same/missing/changed (Nick Craig-Wood)
      • Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood)
      • Make check do --checkers…
Record
openSUSE-SU-2020:2035-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2168-1 No score

Security update for rclone

This update for rclone fixes the following issues:

rclone was updated to version 1.53.3:

  • Bug Fixes

    • Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood)
    • Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone

  • VFS

    • Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood)

  • Sharefile

    • Fix backend due to API swapping integers for strings (Nick Craig-Wood)

Update to 1.53.2:

  • Bug Fixes

    • accounting

      • Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood)
      • Stabilize display order of transfers on Windows (Nick Craig-Wood)

    • operations

      • Fix use of --suffix without --backup-dir (Nick Craig-Wood)
      • Fix spurious '--checksum is in use but the source and destination have no hashes in common' (Nick Craig-Wood)

    • build

      • Work around GitHub actions brew problem (Nick Craig-Wood)
      • Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood)

  • Mount

    • mount2: Fix the swapped UID / GID values (Russell Cattelan)

  • VFS

    • Detect and recover from a file being removed externally from the cache (Nick Craig-Wood)
    • Fix a deadlock vulnerability in downloaders.Close (Leo Luan)
    • Fix a race condition in retryFailedResets (Leo Luan)
    • Fix missed concurrency control between some item operations and reset (Leo Luan)
    • Add exponential backoff during ENOSPC retries (Leo Luan)
    • Add a missed update of used cache space (Leo Luan)
    • Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood)

  • Local

    • Fix sizes and syncing with --links option on Windows (Nick Craig-Wood)

  • Chunker

    • Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev)
    • Fix upload over crypt (Ivan Andreev)

  • Fichier

    • Increase maximum file size from 100GB to 300GB (gyutw)

  • Jottacloud

    • Remove clientSecret from config when upgrading to token based authentication (buengese)
    • Avoid double url escaping of device/mountpoint (albertony)
    • Remove DirMove workaround as it's not required anymore - also (buengese)

  • Mailru

    • Fix uploads after recent changes on server (Ivan Andreev)
    • Fix range requests after june changes on server (Ivan Andreev)
    • Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev)

  • Onedrive

    • Fix disk usage for sharepoint (Nick Craig-Wood)

  • S3

    • Add missing regions for AWS (Anagh Kumar Baranwal)

  • Seafile

    • Fix accessing libraries > 2GB on 32 bit systems (Muffin King)

  • SFTP

    • Always convert the checksum to lower case (buengese)

  • Union

    • Create root directories if none exist (Nick Craig-Wood)

Update to version 1.53.1:

  • Bug Fixes

    • accounting: Remove new line from end of --stats-one-line display

  • VFS

    • Fix spurious error 'vfs cache: failed to _ensure cache EOF'
    • Log an ERROR if we fail to set the file to be sparse

  • Local

    • Log an ERROR if we fail to set the file to be sparse

  • Drive

    • Re-adds special oauth help text

  • Opendrive

    • Do not retry 400 errors

Update to version 1.53.0

  • New Features
    • The VFS layer was heavily reworked for this release - see below for more details
    • Interactive mode -i/--interactive for destructive operations (fishbullet)
    • Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood)
    • Transfers are sorted by start time in the stats and progress output (Max Sum)
    • Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood)
    • Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood)
    • rclone check
      • Add reporting of filenames for same/missing/changed (Nick Craig-Wood)
      • Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood)
      • Make check do --checkers…
Record
openSUSE-SU-2020:2168-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0272-1 No score

Security update for rclone

This update for rclone fixes the following issues:

rclone was updated to version 1.53.3:

  • Bug Fixes
    • Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo#1179005 (Nick Craig-Wood)
    • Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by rclone
  • VFS
    • Fix vfs/refresh calls with fs= parameter (Nick Craig-Wood)
  • Sharefile
    • Fix backend due to API swapping integers for strings (Nick Craig-Wood)

Update to 1.53.2:

  • Bug Fixes
    • accounting
      • Fix incorrect speed and transferTime in core/stats (Nick Craig-Wood)
      • Stabilize display order of transfers on Windows (Nick Craig-Wood)
    • operations
      • Fix use of --suffix without --backup-dir (Nick Craig-Wood)
      • Fix spurious '--checksum is in use but the source and destination have no hashes in common' (Nick Craig-Wood)
    • build
      • Work around GitHub actions brew problem (Nick Craig-Wood)
      • Stop using set-env and set-path in the GitHub actions (Nick Craig-Wood)
  • Mount
    • mount2: Fix the swapped UID / GID values (Russell Cattelan)
  • VFS
    • Detect and recover from a file being removed externally from the cache (Nick Craig-Wood)
    • Fix a deadlock vulnerability in downloaders.Close (Leo Luan)
    • Fix a race condition in retryFailedResets (Leo Luan)
    • Fix missed concurrency control between some item operations and reset (Leo Luan)
    • Add exponential backoff during ENOSPC retries (Leo Luan)
    • Add a missed update of used cache space (Leo Luan)
    • Fix --no-modtime to not attempt to set modtimes (as documented) (Nick Craig-Wood)
  • Local
    • Fix sizes and syncing with --links option on Windows (Nick Craig-Wood)
  • Chunker
    • Disable ListR to fix missing files on GDrive (workaround) (Ivan Andreev)
    • Fix upload over crypt (Ivan Andreev)
  • Fichier
    • Increase maximum file size from 100GB to 300GB (gyutw)
  • Jottacloud
    • Remove clientSecret from config when upgrading to token based authentication (buengese)
    • Avoid double url escaping of device/mountpoint (albertony)
    • Remove DirMove workaround as it's not required anymore - also (buengese)
  • Mailru
    • Fix uploads after recent changes on server (Ivan Andreev)
    • Fix range requests after june changes on server (Ivan Andreev)
    • Fix invalid timestamp on corrupted files (fixes) (Ivan Andreev)
  • Onedrive
    • Fix disk usage for sharepoint (Nick Craig-Wood)
  • S3
    • Add missing regions for AWS (Anagh Kumar Baranwal)
  • Seafile
    • Fix accessing libraries > 2GB on 32 bit systems (Muffin King)
  • SFTP
    • Always convert the checksum to lower case (buengese)
  • Union
    • Create root directories if none exist (Nick Craig-Wood)

Update to version 1.53.1:

  • Bug Fixes
    • accounting: Remove new line from end of --stats-one-line display
  • VFS
    • Fix spurious error 'vfs cache: failed to _ensure cache EOF'
    • Log an ERROR if we fail to set the file to be sparse
  • Local
    • Log an ERROR if we fail to set the file to be sparse
  • Drive
    • Re-adds special oauth help text
  • Opendrive
    • Do not retry 400 errors

Update to version 1.53.0

  • New Features
    • The VFS layer was heavily reworked for this release - see below for more details
    • Interactive mode -i/--interactive for destructive operations (fishbullet)
    • Add --bwlimit-file flag to limit speeds of individual file transfers (Nick Craig-Wood)
    • Transfers are sorted by start time in the stats and progress output (Max Sum)
    • Make sure backends expand ~ and environment vars in file names they use (Nick Craig-Wood)
    • Add --refresh-times flag to set modtimes on hashless backends (Nick Craig-Wood)
    • rclone check
      • Add reporting of filenames for same/missing/changed (Nick Craig-Wood)
      • Make check command obey --dry-run/-i/--interactive (Nick Craig-Wood)
      • Make check do --checkers files concurrently (Nick Craig-Wood) +…
Record
openSUSE-SU-2021:0272-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11297-1 No score

rclone-1.55.1-1.3 on GA media

These are all security issues fixed in the rclone-1.55.1-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11297-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/rclone/rclone
Go
 before 1.53.3
1.53.3
rclone
Bitnami
 before 1.53.3
1.53.3
rclone
Debian:12
 before 1.53.3-1
1.53.3-1
rclone
Debian:13
 before 1.53.3-1
1.53.3-1
Rclone_jll
Julia
 before 1.55.1+0
1.55.1+0
rclone
openSUSE:Leap 15.2
 before 1.53.3-lp152.2.3.1
1.53.3-lp152.2.3.1
rclone
openSUSE:Leap 15.1
 before 1.53.3-lp151.3.6.1
1.53.3-lp151.3.6.1
rclone
SUSE:Package Hub 15 SP1
 before 1.53.3-bp151.4.6.1
1.53.3-bp151.4.6.1
rclone
SUSE:Package Hub 15 SP2
 before 1.53.3-bp152.2.4.11
1.53.3-bp152.2.4.11
rclone
openSUSE:Tumbleweed
 before 1.55.1-1.3
1.55.1-1.3

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28924 is a high vulnerability (CVSS 7.5) in Rclone, published November 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in github.com/rclone/rclone 1.53.3.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open