Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-79776 →

DEBIAN-CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attack...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

advisory security-tracker.debian.org