Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-79779 →
UBUNTU-CVE-2026-79779
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replaye...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:18.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:22.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:24.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:26.04:LTS
rclone
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com