Weak Password Generation in Rclone Affects Data Security

CVE-2020-28924

What is CVE-2020-28924?

An issue identified in Rclone versions before 1.53.3 results from a weak random number generator, producing passwords with significantly lower entropy than claimed. The generated passwords are predictable and primarily determined by the start time of the Rclone process, greatly reducing their complexity. This deficiency allows for the potential creation of a dictionary containing approximately 38 million password variations for each length, enabling possible decryption of encrypted data with a feasible effort. Users of affected versions are strongly advised to change all generated passwords immediately to enhance data security.

References