このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-79779 の詳細 →
UBUNTU-CVE-2026-79779
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replaye...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:18.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:26.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report github.com