Source: rclone Version: 1.69.3+dfsg-3 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for rclone. This is another brach of recently assigned CVEs for rclone issues. CVE-2026-79775[0]: | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain | multiple denial-of-service vulnerabilities in the archive backend's | SquashFS parser, which relies on the github.com/diskfs/go-diskfs | dependency. The parser fails to validate attacker-controlled | superblock and metadata values before use. An attacker who can place | or modify a SquashFS image in storage exposed through an rclone | :archive: remote can craft a malicious image that triggers an | integer division-by-zero panic (zero block size), an out-of-bounds | slice panic (out-of-range inode metadata offset), or a non-progress | CPU loop (truncated metadata stream). Variants 1 and 2 terminate the | rclone process and, via 'rclone serve sftp', can crash the entire | SFTP server; variant 3 causes sustained CPU consumption. Parsing is | lazy, so a victim or remote client must address or descend into the | malicious archive object to trigger it. CVE-2026-79776[1]: | rclone before 1.75.0 mounts the pprof debug handler as its own | router route, bypassing the fail-closed authentication rule in the | main handler. Attackers can access the /debug/pprof/cmdline endpoint | unauthenticated to retrieve the full process argv including backend | credentials. CVE-2026-79777[2]: | rclone before v1.75.0 includes full Go stack traces in RC API error | responses when panics occur. Attackers can trigger panics to leak | internal file paths, module versions, goroutine states, and memory | addresses. CVE-2026-79778[3]: | rclone before v1.75.0 contains a denial of service vulnerability in | the WebDAV TUS creation handler that dereferences a nil response | before checking for transport errors. A malicious or compromised | configured endpoint can reset connections during TUS uploads to | trigger a panic that terminates unrecovered goroutines and halts | unrelated work in long-lived processes. CVE-2026-79779[4]: | rclone versions before v1.75.0 fail to reject transport downgrades | in redirect handling, allowing Basic authorization and Cookie | headers to be replayed over plaintext HTTP after same-host HTTPS-to- | HTTP redirects. An on-path attacker observing the plaintext hop can | capture and reuse credentials to perform WebDAV operations with the | compromised account's permissions. CVE-2026-79780[5]: | rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and | SSE-C encryption keys during S3 redirect callbacks, allowing | credentials to be preserved across scheme or host changes. Attackers | observing network traffic from a trusted endpoint can capture | reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or | SSE-C keys on cross-origin redirects to access protected S3 objects. CVE-2026-79781[6]: | rclone serve s3 before 1.74.4 contains a path traversal | vulnerability that allows attackers to read and overwrite root-level | files by using dot-dot segments in S3 object keys. Attackers can | send requests with object keys like ../root-secret.txt to escape the | bucket namespace and access files in the serve root directory. CVE-2026-79782[7]: | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header | when an S3 redirect changes scheme from HTTPS to HTTP on the same | host. Attackers can intercept plaintext HTTP traffic to capture AWS | STS session tokens sent in request headers. CVE-2026-79783[8]: | rclone before 1.74.4 fails to mask special permission bits when | applying source-supplied mode metadata in the local backend, | allowing attackers to set setuid/setgid bits on attacker-controlled | files. When copying with metadata preservation from an untrusted | remote, attackers can plant a setuid binary that escalates | privileges to root if rclone runs as root, or to the service account | user otherwise. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-79775 https://www.cve.org/CVERecord?id=CVE-2026-79775 [1] https://security-tracker.debian.org/tracker/CVE-2026-79776 https://www.cve.org/CVERecord?id=CVE-2026-79776 [2] https://security-tracker.debian.org/tracker/CVE-2026-79777 https://www.cve.org/CVERecord?id=CVE-2026-79777 [3] https://security-tracker.debian.org/tracker/CVE-2026-79778 https://www.cve.org/CVERecord?id=CVE-2026-79778 [4] https://security-tracker.debian.org/tracker/CVE-2026-79779 https://www.cve.org/CVERecord?id=CVE-2026-79779 [5] https://security-tracker.debian.org/tracker/CVE-2026-79780 https://www.cve.org/CVERecord?id=CVE-2026-79780 [6] https://security-tracker.debian.org/tracker/CVE-2026-79781 https://www.cve.org/CVERecord?id=CVE-2026-79781 [7] https://security-tracker.debian.org/tracker/CVE-2026-79782 https://www.cve.org/CVERecord?id=CVE-2026-79782 [8] https://security-tracker.debian.org/tracker/CVE-2026-79783 https://www.cve.org/CVERecord?id=CVE-2026-79783 Regards, Salvatore
