rclone Go Package Vulnerability: Memory Exhaustion Risk
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- >= 1.75.0, <= 1.75.0
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the rclone Go package that could lead to memory exhaustion in streamed multipart mode. Users of affected versions should take immediate action.
What happened
An early warning has been issued regarding a vulnerability in the rclone Go package. This vulnerability, tracked as GHSA-2P48-J3QC-RX9F, allows for memory exhaustion in streamed multipart mode due to improper memory allocation based on the declared part length. This can potentially lead to process or host exhaustion. The vulnerability affects rclone versions 1.75.0 and is under investigation.
The vulnerability has not been exploited in the wild as of the latest reports. However, due to its potential impact, it is critical for users to assess their exposure and take appropriate action. The rclone team is working on a fix, but no patched version has been released yet.
What to do about it
- Check your rclone version to determine if you are using version 1.75.0, which is affected by this vulnerability.
- If you are using the affected version, monitor the rclone GitHub repository and security advisories for updates on a fix.
- Consider implementing additional monitoring and alerting for unusual memory usage patterns as a temporary measure.
- Stay informed about any updates or patches released by the rclone team to address this vulnerability.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone version 1.75.0.
What should I do right now?
Check your rclone version and monitor for updates on a fix. Implement additional monitoring if necessary.
Is there a patch available?
No official fix has been published yet. Monitor the sources for updates.
Sources
- [GHSA-p569-5gjg-9cmj] rclone: RC per-server auth-proxy bypass
- [GHSA-xwwr-4h3p-r22c] rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- [GHSA-2p48-j3qc-rx9f] rclone: S3 multipart declared-length memory exhaustion
- [GHSA-38xv-hf3p-h7mq] rclone: source object names can escape the configured root on upload
- [GHSA-486v-q2wf-fp2r] rclone: http backend forwards custom/auth headers to a different host on redirect
- [GHSA-66hp-wgxq-6f5q] rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace