[Git][security-tracker-team/security-tracker][master] Track fixed version via unstable for various rclone issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 19 12:07:56 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
1798b6a6 by Salvatore Bonaccorso at 2026-10-19T13:00:32+02:00
Track fixed version via unstable for various rclone issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -39157,12 +39157,12 @@ CVE-2026-93989 (vLLM through 0.29.0 fails to properly validate bad_words token i
CVE-2026-93988 (QloApps through 1.7.0 contains a path traversal vulnerability in the g ...)
NOT-FOR-US: QloApps
CVE-2026-93987 (rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnera ...)
- - rclone <unfixed> (bug #1148669)
+ - rclone 1.75.2-1 (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6
CVE-2026-93986 (rclone before 1.75.1 fails to confine names from server and third-part ...)
- - rclone <unfixed> (bug #1148669)
+ - rclone 1.75.2-1 (bug #1148669)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q
@@ -55375,7 +55375,7 @@ CVE-2026-88047 (Tesseract is an open source OCR engine. In version 5.5.3 and ear
NOTE: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3
NOTE: Fixed by: https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84
CVE-2026-88046 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq
@@ -55458,26 +55458,26 @@ CVE-2026-88022 (Improper neutralization of special elements in data query logic
CVE-2026-88021 (Consul and Consul Enterprise are vulnerable to an authorization bypass ...)
- consul <removed>
CVE-2026-88018 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <not-affected> (Vulnerable code not present, only affects 1.68 and later)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
NOTE: Fixed by: https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd (1.75.1)
CVE-2026-88017 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <not-affected> (Vulnerable code not present, only affects 1.64 and later)
[bookworm] - rclone <not-affected> (Vulnerable code not present, only affects 1.64 and later)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77
NOTE: Fixed by: https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99 (v1.75.1)
CVE-2026-88016 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh
NOTE: Fixed by: https://github.com/rclone/rclone/commit/17b0c03338a857bcb0a68d2d4c82ddbdec3f7893 (v1.75.1)
NOTE: Fixed by: https://github.com/rclone/rclone/commit/a7ab39d3d1958afa1446982c1dc4e4a73a887e3e (v1.75.1)
CVE-2026-88015 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw
@@ -55488,7 +55488,7 @@ CVE-2026-88014 (rclone is a command-line program to sync files and directories t
NOTE: Fixed by: https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0 (v1.75.1)
NOTE: Fixed by: https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98 (v1.75.1)
CVE-2026-88013 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1147404)
+ - rclone 1.75.2-1 (bug #1147404)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r
@@ -74652,47 +74652,47 @@ CVE-2026-79785 (X-AnyLabeling's model downloader disabled TLS certificate verifi
CVE-2026-79784 (Vocos instantiates a class named by a configuration file without restr ...)
NOT-FOR-US: Vocos
CVE-2026-79783 (rclone before 1.74.4 fails to mask special permission bits when applyi ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw
CVE-2026-79782 (rclone before 1.74.4 fails to strip the X-Amz-Security-Token header wh ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-gx4c-2hqx-cw2r
CVE-2026-79781 (rclone serve s3 before 1.74.4 contains a path traversal vulnerability ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
CVE-2026-79780 (rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE- ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-8mxv-9xhp-86h4
CVE-2026-79779 (rclone versions before v1.75.0 fail to reject transport downgrades in ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-h4mf-4v27-hggj
CVE-2026-79778 (rclone before v1.75.0 contains a denial of service vulnerability in th ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv
CVE-2026-79777 (rclone before v1.75.0 includes full Go stack traces in RC API error re ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv
CVE-2026-79776 (rclone before 1.75.0 mounts the pprof debug handler as its own router ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-mfvx-7rcj-9m5g
CVE-2026-79775 (rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain m ...)
- - rclone <unfixed> (bug #1145670)
+ - rclone 1.75.2-1 (bug #1145670)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-6jcg-q3wp-x2f4
@@ -100892,31 +100892,31 @@ CVE-2026-71315 (Nuxt is an open-source web development framework for Vue.js. Fro
CVE-2026-71314 (Nuxt is an open-source web development framework for Vue.js. From 3.1. ...)
NOT-FOR-US: Nuxt
CVE-2026-71313 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1143842)
+ - rclone 1.75.2-1 (bug #1143842)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
NOTE: Fixed by: https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e (v1.75.0)
CVE-2026-71312 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1143842)
+ - rclone 1.75.2-1 (bug #1143842)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2
NOTE: Fixed by: https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88 (v1.75.0)
CVE-2026-71311 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1143842)
+ - rclone 1.75.2-1 (bug #1143842)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37
NOTE: Fixed by: https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c (v1.75.0)
CVE-2026-71310 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1143842)
+ - rclone 1.75.2-1 (bug #1143842)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr
NOTE: Fixed by: https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b (v1.75.0)
CVE-2026-71309 (rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1143842)
+ - rclone 1.75.2-1 (bug #1143842)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh
@@ -122625,13 +122625,13 @@ CVE-2026-59836 (A improper certificate validation vulnerability in Fortinet Fort
CVE-2026-59835 (A exposure of resource to wrong sphere vulnerability in Fortinet Forti ...)
NOT-FOR-US: Fortinet
CVE-2026-59733 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1142269)
+ - rclone 1.75.2-1 (bug #1142269)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg
NOTE: Fixed by: https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d (v1.74.4)
CVE-2026-59732 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1142269)
+ - rclone 1.75.2-1 (bug #1142269)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
@@ -123161,7 +123161,7 @@ CVE-2026-54982 (Integer underflow (wrap or wraparound) in Reliable Multicast Tra
CVE-2026-54684 (jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xa ...)
NOT-FOR-US: jadx
CVE-2026-54572 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1142269)
+ - rclone 1.75.2-1 (bug #1142269)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc
@@ -139256,7 +139256,7 @@ CVE-2026-50699 (A Stored Cross-Site Scripting (XSS) vulnerability exists in Frap
CVE-2026-50698 (A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Fra ...)
NOT-FOR-US: Frappe
CVE-2026-49980 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1140817)
+ - rclone 1.75.2-1 (bug #1140817)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue; requires an rclone rcd --rc-serve listener reachable by the attacker without rc HTTP auth)
[bullseye] - rclone <postponed> (Limited support, minor issue; requires an rclone rcd --rc-serve listener reachable by the attacker without rc HTTP auth)
@@ -182949,7 +182949,7 @@ CVE-2026-41182 (LangSmith Client SDKs provide SDK's for interacting with the Lan
CVE-2026-41180 (PsiTransfer is an open source, self-hosted file sharing solution. Prio ...)
NOT-FOR-US: PsiTransfer
CVE-2026-41179 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1134735)
+ - rclone 1.75.2-1 (bug #1134735)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue; requires an rclone rc listener reachable by the attacker without rc HTTP auth)
[bullseye] - rclone <not-affected> (Inline backend option overrides via connection strings introduced in 1.55.0; operations/fsinfo in 1.53.3 cannot instantiate an attacker-defined backend)
@@ -182958,7 +182958,7 @@ CVE-2026-41179 (Rclone is a command-line program to sync files and directories t
CVE-2026-41177 (Squidex is an open source headless content management system and conte ...)
NOT-FOR-US: Squidex
CVE-2026-41176 (Rclone is a command-line program to sync files and directories to and ...)
- - rclone <unfixed> (bug #1134734)
+ - rclone 1.75.2-1 (bug #1134734)
[trixie] - rclone <no-dsa> (Minor issue)
[bookworm] - rclone <postponed> (Limited support, minor issue; requires an rclone rc listener reachable by the attacker without rc HTTP auth)
[bullseye] - rclone <postponed> (Limited support, minor issue; requires an rclone rc listener reachable by the attacker without rc HTTP auth)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1798b6a63209090594a93ae1e0e55db75704e770
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1798b6a63209090594a93ae1e0e55db75704e770
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261019/a0f77e45/attachment.htm>
More information about the debian-security-tracker-commits
mailing list