An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the     password generator has been producing weak passwords with much less entropy than advertised. The suggested     passwords depend deterministically on the time the second rclone was started. This limits the entropy of     the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It     would be possible to make a dictionary of all possible passwords with about 38 million entries per     password length. This would make decryption of secret material possible with a plausible amount of effort.
    NOTE: all passwords generated by affected versions should be changed. (CVE-2020-28924)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the
    password generator has been producing weak passwords with much less entropy than advertised. The suggested
    passwords depend deterministically on the time the second rclone was started. This limits the entropy of
    the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It
    would be possible to make a dictionary of all possible passwords with about 38 million entries per
    password length. This would make decryption of secret material possible with a plausible amount of effort.
    NOTE: all passwords generated by affected versions should be changed. (CVE-2020-28924)

The remote host is affected by the vulnerability described in GLSA-202107-14 (rclone: Weak random number generation)

    Passwords generated with rclone were insecurely generated and are       vulnerable to brute-force attacks.
  Impact :

    Data kept secret with a password generated by rclone may be disclosed to       a local attacker.
  Workaround :

    There is no known workaround at this time.

Update to 1.53.3 Security fix for CVE-2020-28924

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
250536	Linux Distros Unpatched Vulnerability : CVE-2020-28924	Nessus	Misc.	high
418826	SCA: security update for github.com/rclone/rclone (GHSA-rmw5-xpg9-jr29)	Tenable Cloud Security	SCA Checks	high
418826	SCA: security update for github.com/rclone/rclone (GHSA-rmw5-xpg9-jr29)	Tenable Self-Hosted Container Security	SCA Checks	high
157021	GLSA-202107-14 : rclone: Weak random number generation	Nessus	Gentoo Local Security Checks	high
144246	Fedora 33 : rclone (2020-3b0bb05117)	Nessus	Fedora Local Security Checks	high
143316	openSUSE Security Update : rclone (openSUSE-2020-2035)	Nessus	SuSE Local Security Checks	high
143289	openSUSE Security Update : rclone (openSUSE-2020-2008)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-28924

high

Tenable Plugins

high

high

high

high

high

high

high