An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

The remote host is affected by the vulnerability described in GLSA-202107-14 (rclone: Weak random number generation)

    Passwords generated with rclone were insecurely generated and are       vulnerable to brute-force attacks.
  Impact :

    Data kept secret with a password generated by rclone may be disclosed to       a local attacker.
  Workaround :

    There is no known workaround at this time.

Update to 1.53.3 Security fix for CVE-2020-28924

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
157021	GLSA-202107-14 : rclone: Weak random number generation	Nessus	Gentoo Local Security Checks	high
144246	Fedora 33 : rclone (2020-3b0bb05117)	Nessus	Fedora Local Security Checks	high
143316	openSUSE Security Update : rclone (openSUSE-2020-2035)	Nessus	SuSE Local Security Checks	high
143289	openSUSE Security Update : rclone (openSUSE-2020-2008)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-28924

high

Tenable Plugins

high

high

high

high