Your message dated Mon, 19 Oct 2026 10:35:11 +0000
with message-id <[email protected]>
and subject line Bug#1145670: fixed in rclone 1.75.2-1
has caused the Debian Bug report #1145670,
regarding rclone: CVE-2026-79775 CVE-2026-79776 CVE-2026-79777 CVE-2026-79778
CVE-2026-79779 CVE-2026-79780 CVE-2026-79781 CVE-2026-79782 CVE-2026-79783
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145670: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145670
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rclone
Version: 1.69.3+dfsg-3
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for rclone.
This is another brach of recently assigned CVEs for rclone issues.
CVE-2026-79775[0]:
| rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain
| multiple denial-of-service vulnerabilities in the archive backend's
| SquashFS parser, which relies on the github.com/diskfs/go-diskfs
| dependency. The parser fails to validate attacker-controlled
| superblock and metadata values before use. An attacker who can place
| or modify a SquashFS image in storage exposed through an rclone
| :archive: remote can craft a malicious image that triggers an
| integer division-by-zero panic (zero block size), an out-of-bounds
| slice panic (out-of-range inode metadata offset), or a non-progress
| CPU loop (truncated metadata stream). Variants 1 and 2 terminate the
| rclone process and, via 'rclone serve sftp', can crash the entire
| SFTP server; variant 3 causes sustained CPU consumption. Parsing is
| lazy, so a victim or remote client must address or descend into the
| malicious archive object to trigger it.
CVE-2026-79776[1]:
| rclone before 1.75.0 mounts the pprof debug handler as its own
| router route, bypassing the fail-closed authentication rule in the
| main handler. Attackers can access the /debug/pprof/cmdline endpoint
| unauthenticated to retrieve the full process argv including backend
| credentials.
CVE-2026-79777[2]:
| rclone before v1.75.0 includes full Go stack traces in RC API error
| responses when panics occur. Attackers can trigger panics to leak
| internal file paths, module versions, goroutine states, and memory
| addresses.
CVE-2026-79778[3]:
| rclone before v1.75.0 contains a denial of service vulnerability in
| the WebDAV TUS creation handler that dereferences a nil response
| before checking for transport errors. A malicious or compromised
| configured endpoint can reset connections during TUS uploads to
| trigger a panic that terminates unrecovered goroutines and halts
| unrelated work in long-lived processes.
CVE-2026-79779[4]:
| rclone versions before v1.75.0 fail to reject transport downgrades
| in redirect handling, allowing Basic authorization and Cookie
| headers to be replayed over plaintext HTTP after same-host HTTPS-to-
| HTTP redirects. An on-path attacker observing the plaintext hop can
| capture and reuse credentials to perform WebDAV operations with the
| compromised account's permissions.
CVE-2026-79780[5]:
| rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and
| SSE-C encryption keys during S3 redirect callbacks, allowing
| credentials to be preserved across scheme or host changes. Attackers
| observing network traffic from a trusted endpoint can capture
| reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or
| SSE-C keys on cross-origin redirects to access protected S3 objects.
CVE-2026-79781[6]:
| rclone serve s3 before 1.74.4 contains a path traversal
| vulnerability that allows attackers to read and overwrite root-level
| files by using dot-dot segments in S3 object keys. Attackers can
| send requests with object keys like ../root-secret.txt to escape the
| bucket namespace and access files in the serve root directory.
CVE-2026-79782[7]:
| rclone before 1.74.4 fails to strip the X-Amz-Security-Token header
| when an S3 redirect changes scheme from HTTPS to HTTP on the same
| host. Attackers can intercept plaintext HTTP traffic to capture AWS
| STS session tokens sent in request headers.
CVE-2026-79783[8]:
| rclone before 1.74.4 fails to mask special permission bits when
| applying source-supplied mode metadata in the local backend,
| allowing attackers to set setuid/setgid bits on attacker-controlled
| files. When copying with metadata preservation from an untrusted
| remote, attackers can plant a setuid binary that escalates
| privileges to root if rclone runs as root, or to the service account
| user otherwise.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-79775
https://www.cve.org/CVERecord?id=CVE-2026-79775
[1] https://security-tracker.debian.org/tracker/CVE-2026-79776
https://www.cve.org/CVERecord?id=CVE-2026-79776
[2] https://security-tracker.debian.org/tracker/CVE-2026-79777
https://www.cve.org/CVERecord?id=CVE-2026-79777
[3] https://security-tracker.debian.org/tracker/CVE-2026-79778
https://www.cve.org/CVERecord?id=CVE-2026-79778
[4] https://security-tracker.debian.org/tracker/CVE-2026-79779
https://www.cve.org/CVERecord?id=CVE-2026-79779
[5] https://security-tracker.debian.org/tracker/CVE-2026-79780
https://www.cve.org/CVERecord?id=CVE-2026-79780
[6] https://security-tracker.debian.org/tracker/CVE-2026-79781
https://www.cve.org/CVERecord?id=CVE-2026-79781
[7] https://security-tracker.debian.org/tracker/CVE-2026-79782
https://www.cve.org/CVERecord?id=CVE-2026-79782
[8] https://security-tracker.debian.org/tracker/CVE-2026-79783
https://www.cve.org/CVERecord?id=CVE-2026-79783
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: rclone
Source-Version: 1.75.2-1
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
rclone, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated rclone package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 06:13:44 -0400
Source: rclone
Architecture: source
Version: 1.75.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1134734 1134735 1140817 1142269 1143842 1145670 1147404 1148669 1150968
Changes:
rclone (1.75.2-1) unstable; urgency=medium
.
* Team upload.
* Fixes security vulnerabilities:
- CVE-2026-41176 (Closes: #1134734)
- CVE-2026-41179 (Closes: #1134735)
- CVE-2026-49980 (Closes: #1140817)
- CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269)
- CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312,
CVE-2026-71313 (Closes: #1143842)
- CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778,
CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782,
CVE-2026-79783 (Closes: #1145670)
- CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016,
CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045,
CVE-2026-88046 (Closes: #1147404)
- CVE-2026-93986, CVE-2026-93987 (Closes: #1148669)
* Refresh patches against upstream 1.75.2.
* dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968).
* debian/control:
- Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends.
- Replace obsolete golang-gopkg-yaml.v2-dev with
golang-gopkg-yaml.v3-dev.
- Drop obsolete golang-github-anacrolix-log-dev.
* Disable backends with dependencies not yet updated/available in Debian:
- backend/dropbox: disabled because it requires
golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with
ContextClient support (Debian currently has 6.0.5).
- backend/mega: disabled because it requires
golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or
newer for LoginWithKeys and session export APIs.
- backend/compress: disabled due to unpackaged zstd-seekable-format-go.
- backend/archive, backend/filen, backend/internxt, backend/protondrive,
cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged
dependencies.
- dropbox and mega backends, drop unused log in dlna
* debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends.
* d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1
* d/rules, d/changelog: fix lintian warnings for nproc, changelog line
length, and privacy breaches
* debian/patches: amend FTP patch to drop cmd/all import, renumber and
DEP-3 hygiene
* d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop
anacrolix-log
* debian/patches: consolidate and fold backend/dlna patches via gbp pq
* debian/control: upgrade debhelper-compat to 14
Checksums-Sha1:
5bff1129813963ea029e52d64217c615e29cdd85 5406 rclone_1.75.2-1.dsc
6771ed84a736fafe11afe988369263b809a15046 13684312 rclone_1.75.2.orig.tar.xz
758d8ed0b7964a2b6d99092ca8b3c07526acd722 30800 rclone_1.75.2-1.debian.tar.xz
Checksums-Sha256:
dd3f87c563986e70f020b7c32a8fe0ec217144308c857b76b770baa4ccbcf48d 5406
rclone_1.75.2-1.dsc
4686f58c8a530ab40be693fce81aaae8125a692012123a5a45981bad48d8a62d 13684312
rclone_1.75.2.orig.tar.xz
4e60798a2fefd557c6cd0284113b88b629c1f60b22e2aa623a338545aca00966 30800
rclone_1.75.2-1.debian.tar.xz
Files:
e78558580647a4acdfa73318574e3018 5406 net optional rclone_1.75.2-1.dsc
17560887fd4fb71ceae80fad70718c46 13684312 net optional
rclone_1.75.2.orig.tar.xz
fda7e2aad58858d1abdd2692158b4cdd 30800 net optional
rclone_1.75.2-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrV7l8UHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsuJzg/8CbHh5QY0dqNmJhS41ew16M5TrrPn
+OHC+OusBJ4U9SACdCYD8FJNdOHrjvv6LITWUbb0a/RkPssKAj0NZQFXZS2lcbYV
Uf5oIGs/oI5CLvwQKnUAn1MRzrIsnY+m+FfXdwlADhnJ2J7j28oBqR7MKfnXyOdS
cqInUDUuCcvYxg7geVWOEr34qleonL9ZUzS4OWOWdAUUixZIUn7Gq9MEQC38sVZp
D8RV/8HUgKX1XLQjbNlxYkYOYIqgeOEaHF6osRk2G7fRXSPA0eh/dzFhM8H6gisZ
d5vWU255QgIQNhsr39LLUtHDOYQUWnzWh48UP6JcUP9Bs9sbgP7nTKoZrJ2TkC71
eQC4CqXzWGeBNmk6GQUmEMx6ia2mp+RrWvBlNgdKduoEwnHIV3t3fec6PdpQyD8h
BSaBNHzrlMHsuK1jEueCwuOBJuPD0+VQPR3m/HLmUKwi7NVKqYEqcOJnvasL4CdD
WOe7O9mtVYhMbqIVT9EcoGmoc9nXTlFGsRmZoGTZVDjD5uYhINPnN0xIWBgqbATi
kltmSWnB9x5QBolW3/o6L+5uxlGZRuaE1WKAGlEpyaVRMjhfqmiGO0BOf/Ok2kXS
9fRaL8waAOzo78UcFY2hf0wrTM96V4Syzzjr/P3gWDL2TxpUO+/BOwgLl/Pf5avU
8cQrLV4RzqknTpE=
=xfug
-----END PGP SIGNATURE-----
pgpK0ZzrVgZyg.pgp
Description: PGP signature
--- End Message ---
