THREAT OPS › Threat News › [GHSA] GHSA-945v-v9p3-v5xw (low) — rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
[GHSA] GHSA-945v-v9p3-v5xw (low) — rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
GHSA-945v-v9p3-v5xw Severity: low CVE: None
rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
### Summary When writing an object with metadata, the local backend applies the source-supplied `mode`, `uid`, and `gid` verbatim: it parses `mode` as an octal integer and passes it straight into `os.Chmod(o.path, os.FileMode(umode))`, and pa
Indicators of compromise
- https://downloads.rclone.org/v1.74.3/rclone-v1.74.3-linux-amd64.zipurl
Original source: https://github.com/advisories/GHSA-945v-v9p3-v5xw