A vulnerability in virtualenv prior to version 21.14.9 allows deletion of files outside the intended environment during environment creation if existing seed-package metadata is reused. This occurs due to improper handling of metadata paths, which can lead to deletion of files outside the environment root with the invoking user's permissions. Fresh environments or those created with --clear are not affected. The issue is fixed in version 21.14.9.
A vulnerability in virtualenv prior to version 21.14.9 affects the POSIX xonsh activation script generation. When using legacy multibyte codecs like GBK or Big5, the UTF-8 encoded activate.xsh script can be misinterpreted, allowing an attacker to inject and execute arbitrary statements when the script is sourced. This issue is resolved in version 21.14.9.
A vulnerability in virtualenv prior to version 21.14.9 allows pip seeding with the --download option to bypass wheel digest verification when using the default PyPI index. This occurs because the verification path is skipped, potentially allowing selection of a wheel matching the package and version without verifying its SHA-256 digest against PyPI metadata. The issue does not affect TLS security or allow control over the index response. It is fixed in version 21.14.9.
virtualenv versions prior to 21.14.9 contain a vulnerability where the builtin environment creator follows symlinked directories during creation. This behavior can cause interpreter creation, seed installation, and activation generation to write outside the intended virtual environment directory if another local user has prepared a linked directory accessible to the invoking user. The issue is fixed in version 21.14.9.
A vulnerability in virtualenv prior to version 21.14.9 allows an untrusted caller who can influence the destination pathname to inject line-boundary characters into the pyvenv.cfg configuration file. This can alter configuration keys such as 'home' and 'include-system-site-packages', potentially weakening environment isolation or changing the standard library files loaded by the interpreter. The issue is fixed in version 21.14.9.
A vulnerability in virtualenv prior to version 21.14.9 allows a controlled package index to inject misleading verification data during wheel download and caching. This can cause the tool to cache and potentially select unverified or rejected archives due to forged metadata or manipulated cache files. The issue is fixed in version 21.14.9.
virtualenv versions from 21.14.8 up to but not including 21.14.10 have a vulnerability where temporary app-data seeding can leave dangling symbolic links to package files that are deleted after environment creation. This causes the created environment to depend on cache paths no longer controlled by its owner. The issue is fixed in version 21.14.10.
Rclone versions prior to 1.75.2 have a vulnerability in the b2 backend where live account Authorization tokens and SSE-C keys can be leaked via HTTP redirects when using the --b2-download-url option. This occurs due to HTTPS-to-HTTP downgrade redirects or cross-host redirects that expose sensitive credentials. The issue is fixed in version 1.75.2.
Rclone versions before 1.75.2 have a path traversal vulnerability in the local backend's translateLink function. This flaw occurs because the function trims the .rclonelink suffix after performing a containment check, allowing a path to resolve outside the intended destination root. An attacker can exploit this by planting a specially named directory in a source tree synced with --links and --metadata, potentially modifying ownership, timestamps, and extended attributes of the destination's parent directory.
Rclone versions from 1.52.0 up to but not including 1.75.2 contain a cross-site request forgery (CSRF) vulnerability in the pCloud backend's localhost OAuth callback. This flaw disables the state check and trusts the hostname parameter, allowing malicious web pages to send unauthorized requests to the local OAuth callback port. As a result, attacker tokens and API hosts can be planted, causing subsequent transfers to be redirected to the attacker.
Rclone versions from 1.64.0 up to but not including 1.75.2 have an authentication bypass vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS HTTP requests. Exploitation enables attackers to probe arbitrary paths and use the Allow header values to determine the existence of files or collections, effectively allowing namespace enumeration.
rclone versions from 1.37 up to but not including 1.74.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to redirect HTTP and NetStorage backend requests by supplying a double-slash root on an existing named remote via the --rc-serve option. Exploitation enables attackers to make HEAD or GET requests to attacker-controlled hosts, potentially reading responses, capturing configured custom headers, or obtaining valid NetStorage request signatures. The vulnerability is fixed in version 1.74.2.
Rclone versions prior to 1.75.2 have a path traversal vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to write files outside the intended served root directory by using an unvalidated '..' path component. Exploitation involves sending MKCOL /.. to create a virtual file system node, followed by PUT, MOVE, COPY, or MKCOL requests to manipulate files belonging to other tenants.
rclone versions from 1.56.0 up to but not including 1.75.2 have an information disclosure vulnerability in the WebDAV backend. This flaw causes custom credential headers configured by the operator to be forwarded to different hosts during HTTP 3xx redirects. An attacker who can control or influence such redirects may capture sensitive headers like X-Auth-Token and reuse them against the original WebDAV service. The issue is fixed in version 1.75.2.
rclone versions from 1.55.0 up to but not including 1.75.2 contain a vulnerability in the stable selfupdate mechanism. The flaw allows an attacker controlling the release distribution path to bypass signature verification by prepending an unsigned checksum line that matches a malicious archive. This causes the selfupdate process to install a malicious rclone executable. The issue is fixed in version 1.75.2.
rclone serve s3 versions 1.75.0 up to but not including 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting. This flaw allows attackers to bypass the configured buffer memory limit by opening two concurrent current-part PUT requests with large declared lengths, causing the signed int64 counter to wrap and retain out-of-order parts in memory. This can exhaust the host's memory resources. The issue is fixed in version 1.75.2.
Rclone versions from 1.68.0 up to but not including 1.75.2 contain an authorization bypass vulnerability in the serve s3 --auth-proxy feature. This flaw allows authenticated tenants to manipulate multipart uploads belonging to other tenants by referencing their upload IDs. Attackers who know a victim's bucket, object, and upload ID can inject parts, complete, or abort uploads in progress and view metadata across tenants. The issue is fixed in version 1.75.2.
A heap buffer overflow vulnerability exists in Pillow versions from 9.4.0 up to but not including 13.0.0. The flaw occurs when the JPEG encoder buffer is exactly filled by an ICC profile, allowing an attacker-controlled JPEG comment to overwrite adjacent heap memory. This can lead to process crashes and potentially code execution under certain runtime and heap conditions. The issue is fixed in Pillow version 13.0.0.
A heap over-read vulnerability exists in Pillow's WMF/EMF rendering on Windows prior to version 13.0.0. The issue arises from 16-bit truncation of dimensions used for memory allocation, while pixel data copying uses full 32-bit dimensions. This mismatch can cause the renderer to read beyond allocated heap memory, potentially leading to memory disclosure or application crashes. The vulnerability is fixed in Pillow 13.0.0.
A vulnerability in the Pillow Python imaging library versions 11.0.0 through 12.x causes EXIF parsing to run in quadratic time when processing PNG files with specially crafted eXIf chunks. This leads to excessive CPU consumption during common image operations involving EXIF data, such as photo rotation. The issue is fixed in version 13.0.0.