CVE-2020-28924: Weak RNG
An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28924?
CVE-2020-28924 has a high severity score of 7.5 according to the CVSS v3.1 standard.
How do I fix CVE-2020-28924?
To fix CVE-2020-28924, update Rclone to version 1.53.3 or later, where the weak random number generator issue has been addressed.
What effect does CVE-2020-28924 have on password generation?
CVE-2020-28924 causes Rclone to generate weak passwords with less entropy, making them easier to predict.
Is there a patch available for CVE-2020-28924?
Yes, a patch is available that resolves the weak random number generator issue in Rclone.
Which versions of Rclone are affected by CVE-2020-28924?
Rclone versions prior to 1.53.3 are affected by CVE-2020-28924.