Your message dated Thu, 22 Oct 2026 01:35:23 +0000
with message-id <[email protected]>
and subject line Bug#1143842: fixed in rclone 1.75.2-2
has caused the Debian Bug report #1143842,
regarding rclone: CVE-2026-71309 CVE-2026-71310 CVE-2026-71311 CVE-2026-71312
CVE-2026-71313
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143842: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143842
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rclone
Version: 1.69.3+dfsg-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for rclone.
CVE-2026-71309[0]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.40.0 until
| 1.75.0, rclone serve restic does not correctly reject URL paths
| beginning with ../ in cmd/serve/restic/restic.go WithRemote, which
| accepts a leading parent path and passes it to GET, HEAD, POST, and
| DELETE handlers for configured backends including WebDAV, FTP, HTTP,
| Memory, and SFTP. An attacker who can access the REST endpoint may
| read, create, overwrite, or delete objects outside the path
| configured by the operator when the operator publishes a backend
| subdirectory and the backend credential can access parent or sibling
| objects. This issue is fixed in 1.75.0.
CVE-2026-71310[1]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.0, the
| shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT
| responses with http.ReadResponse over an unrestricted buffered
| reader, allowing a malicious or compromised configured proxy, or an
| active on-path actor controlling a plaintext HTTP proxy hop, to send
| oversized headers that grow memory until the rclone process fails.
| The affected helper is used by FTP and SFTP proxy connections, and
| SFTP reaches the parser before SSH server authentication, so target
| host key validation does not constrain a malicious proxy. This issue
| is fixed in 1.75.0.
CVE-2026-71311[2]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.0, a valid
| but nondefault FTP filename encoding in backend/ftp/ftp.go can
| restore raw CR/LF immediately before an attacker-controlled path is
| interpolated into the line-oriented FTP control channel, and
| github.com/jlaffaye/ftp formats the argument through
| textproto.Conn.Cmd without rejecting CR or LF, allowing a filename
| such as victim CRLF DELE other-secret CRLF NOOP to inject an
| independent authenticated FTP command when the victim copies or
| syncs to a more-privileged FTP destination. This issue is fixed in
| 1.75.0.
CVE-2026-71312[3]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to v1.75.0, rclone
| interpolates remote SFTP paths into PowerShell hash commands in
| backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII
| apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and
| U+201B as single-quote delimiters, allowing an attacker-controlled
| filename to terminate the intended path literal and append
| PowerShell statements that execute as the victim SSH account when
| server-side hashing is invoked. This issue is fixed in v1.75.0.
CVE-2026-71313[4]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From v1.51.0 until
| v1.75.0, the local backend in backend/local/local.go relies on the
| configurable filename encoder to prevent remote filename data from
| becoming operating-system path syntax, so a local destination using
| Slash, None, Raw, or on Windows an encoding that preserves backslash
| can decode a standard-encoded fullwidth dot-dot component or native
| backslash form into an actual parent-directory component before
| filepath.Join resolves it outside the configured local root,
| allowing an attacker-controlled source object to create or overwrite
| files outside the selected destination directory as the rclone
| process. This issue is fixed in v1.75.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-71309
https://www.cve.org/CVERecord?id=CVE-2026-71309
[1] https://security-tracker.debian.org/tracker/CVE-2026-71310
https://www.cve.org/CVERecord?id=CVE-2026-71310
[2] https://security-tracker.debian.org/tracker/CVE-2026-71311
https://www.cve.org/CVERecord?id=CVE-2026-71311
[3] https://security-tracker.debian.org/tracker/CVE-2026-71312
https://www.cve.org/CVERecord?id=CVE-2026-71312
[4] https://security-tracker.debian.org/tracker/CVE-2026-71313
https://www.cve.org/CVERecord?id=CVE-2026-71313
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: rclone
Source-Version: 1.75.2-2
Done: Drew Parsons <[email protected]>
We believe that the bug you reported is fixed in the latest version of
rclone, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Drew Parsons <[email protected]> (supplier of updated rclone package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 02:22:40 +0200
Source: rclone
Architecture: source
Version: 1.75.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Drew Parsons <[email protected]>
Closes: 1134470 1134734 1134735 1135744 1140817 1142269 1143842 1145670 1147404
1148669 1150418 1150968
Changes:
rclone (1.75.2-2) unstable; urgency=medium
.
* Team upload.
* drop deprecated Depends: golang-github-artyom-mtab-dev
* update 0018-Disable-unsupported-backends-and-commands-in-Debian.patch
to reinstate supported backends: compress, dropbox, iclouddrive, mega
- Depends: golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0~)
* drop deprecated patches
0019-Disable-extsort-and-adjust-go-ordered-map-import.patch
0020-Disable-IBM-Cloud-IAM-authenticator.patch
* disable_backend_archive_no_diskfs.patch and disable_backend_internxt.patch
are merged into
0018-Disable-unsupported-backends-and-commands-in-Debian.patch
* new release updates pcloud support. Closes: #1134470
* golang-github-rclone-proton-api-bridge-dev replaces
golang-github-henrybear327-proton-api-bridge-dev supporting Proton Drive.
Closes: #1135744
.
rclone (1.75.2-1) unstable; urgency=medium
.
* Team upload.
* Fixes security vulnerabilities:
- CVE-2026-41176 (Closes: #1134734)
- CVE-2026-41179 (Closes: #1134735)
- CVE-2026-49980 (Closes: #1140817)
- CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269)
- CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312,
CVE-2026-71313 (Closes: #1143842)
- CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778,
CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782,
CVE-2026-79783 (Closes: #1145670)
- CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016,
CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045,
CVE-2026-88046 (Closes: #1147404)
- CVE-2026-93986, CVE-2026-93987 (Closes: #1148669)
* Refresh patches against upstream 1.75.2.
* dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968).
* debian/control:
- Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends.
- Replace obsolete golang-gopkg-yaml.v2-dev with
golang-gopkg-yaml.v3-dev.
- Drop obsolete golang-github-anacrolix-log-dev.
* Disable backends with dependencies not yet updated/available in Debian:
- backend/dropbox: disabled because it requires
golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with
ContextClient support (Debian currently has 6.0.5).
- backend/mega: disabled because it requires
golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or
newer for LoginWithKeys and session export APIs.
- backend/compress: disabled due to unpackaged zstd-seekable-format-go.
- backend/archive, backend/filen, backend/internxt, backend/protondrive,
cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged
dependencies.
- dropbox and mega backends, drop unused log in dlna
* debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends.
* d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1
* d/rules, d/changelog: fix lintian warnings for nproc, changelog line
length, and privacy breaches
* debian/patches: amend FTP patch to drop cmd/all import, renumber and
DEP-3 hygiene
* d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop
anacrolix-log
* debian/patches: consolidate and fold backend/dlna patches via gbp pq
* debian/control: upgrade debhelper-compat to 14
.
rclone (1.74.3-1) experimental; urgency=medium
.
* Team upload.
.
[ Drew Parsons ]
* New upstream version 1.74.3
- fixes RC authentication [CVE-2026-41176][CVE-2026-41179]
Closes: #1134734, #1134735
- fixes authentication vulnerability [CVE-2026-49980].
Closes: #1140817
* README.Debian documents backends, commands and other features
disabled in the debian build since dependencies are not (yet)
packaged for Debian.
* update patches disabling features due to missing dependencies
- disable_backend_archive_no_diskfs.patch: disables the new
archive (squashfs) backend (requires diskfs)
- disable_backend_internxt.patch: internxt backend requres
internxt/rclone-adapter
- update disable_backend_file.patch to disable filen backend
(requires FilenCloudDienste/filen-sdk-go)
- serve_dlna_slog.patch uses slog instead of anacrolix/log with
serve/dlna (for anacrolix/dms 1.8.0). See upstream commit 8a91f15.
* drop Files-Excluded from debian/copyright and Repack from debian/watch
* update Dependencies against current go.mod
- new Depends:
golang-github-adrg-xdg-dev
golang-github-a1ex3-zstd-seekable-format-go-dev
golang-github-golang-jwt-jwt-v5-dev (>= 5.3.1~)
golang-github-ibm-go-sdk-core-v5-dev
golang-github-lanrat-extsort-dev
golang-github-mattn-go-runewidth-dev
golang-github-mholt-archives-dev
golang-github-minio-minio-go-v7-dev
golang-github-muesli-reflow-dev
golang-github-peterh-liner-dev
golang-github-pmezard-go-difflib-dev
golang-github-prometheus-client-golang-dev
golang-github-rclone-go-proton-api-dev
golang-github-rclone-proton-api-bridge-dev
golang-github-rivo-uniseg-dev
golang-github-rogpeppe-go-internal-dev
golang-github-wk8-go-ordered-map-dev
golang-github-zeebo-blake3-dev
golang-github-zeebo-xxh3-dev
golang-golang-x-oauth2-dev
golang-golang-x-sync-dev
golang-gopkg-natefinch-lumberjack.v2-dev
golang-gopkg-yaml.v3-dev
golang-github-moul-http2curl-dev
golang-github-protonmail-go-crypto-dev
golang-github-pkg-xattr-dev
golang-github-pquerna-otp-dev
golang-golang-x-mobile-dev
golang-golang-x-term-dev
- update versioned Dependencies:
golang-github-aalpar-deheap-dev (>= 1.1.2~)
golang-github-anacrolix-dms-dev (>= 1.7.2~)
golang-github-anacrolix-log-dev (>= 0.17.0~)
golang-github-atotto-clipboard-dev (>= 0.1.4~)
golang-github-aws-aws-sdk-go-v2-dev (>= 1.41.5~)
golang-github-cloudsoda-go-smb2-dev (>= 0.0~20250228.d4c70e6~)
golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.0.5~)
golang-github-go-chi-chi-dev (>= 5.2.5~)
golang-github-hanwen-go-fuse-dev (>= 2.9.0~)
golang-github-klauspost-compress-dev (>= 1.18.5~)
golang-github-mattn-go-colorable-dev (>= 0.1.14~)
golang-github-ncw-swift-v2-dev (>= 2.0.5~)
golang-github-pkg-sftp-dev (>= 1.13.10~)
golang-github-rfjakob-eme-dev (>= 1.2.0~)
golang-github-shirou-gopsutil-dev (>= 4.26.3~)
golang-github-spf13-cobra-dev (>= 1.10.2~)
golang-github-spf13-pflag-dev (>= 1.0.10~)
golang-github-stretchr-testify-dev (>= 1.11.1~)
golang-github-t3rm1n4l-go-mega-dev (>= 0.0~git20251120.6845944~)
golang-golang-x-text-dev (>= 0.37.0~)
golang-google-api-dev (>= 0.275.0~)
golang-github-golang-jwt-jwt-dev (>= 5.0.0+really4.5.2~)
- removed Dependencies no longer required
golang-github-djherbis-times-dev
golang-github-henrybear327-go-proton-api-dev
golang-github-henrybear327-proton-api-bridge-dev
golang-github-hirochachacha-go-smb2-dev
golang-github-iguanesolutions-go-systemd-dev
golang-github-go-chi-chi-dev
golang-github-ncw-go-acd-dev
golang-github-nsf-termbox-go-dev
golang-github-okzk-sdnotify-dev
golang-github-pkg-errors-dev
golang-github-pkg-sftp-dev
golang-github-pkg-xattr-dev
golang-github-protonmail-go-crypto-dev
golang-github-rclone-ftp-dev
golang-github-sevlyar-go-daemon-dev
golang-github-sirupsen-logrus-dev
golang-golang-x-oauth2-google-dev
golang-gopkg-yaml.v2-dev
* update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~)
Closes: #1150418
* update DH_GOLANG_INSTALL_EXTRA installing extra files required
during build
* enable iclouddrive backend: remove iclouddrive skips in
disable_backend_file.patch
.
[ Marcos Talau ]
* debian/salsa-ci.yml: Add to provide CI tests for Salsa
* Enable Salsa CI using default template
Checksums-Sha1:
71df31c0ff87c5c2249311297653e77477815f1d 5507 rclone_1.75.2-2.dsc
b205fd5072c7fe68f06a58cad150b0cd22a64e0e 27984 rclone_1.75.2-2.debian.tar.xz
bc4d08702e89ecf4460d8f12ed3b519c556d4e32 27302 rclone_1.75.2-2_amd64.buildinfo
Checksums-Sha256:
2f70f4ed51dbd20bc8772b1621a2b0bac760cea032b531c38c91d3883dd34670 5507
rclone_1.75.2-2.dsc
5c45ec7749cbd921cefbeaff2cc86e779afd0df92f05539adea95b8ad30afb61 27984
rclone_1.75.2-2.debian.tar.xz
eef476407cb26d3a92bb25992087a3faa2a51a945afe6d950e719615ab7056ef 27302
rclone_1.75.2-2_amd64.buildinfo
Files:
735dbf44246caccf46af936a76fda4e8 5507 net optional rclone_1.75.2-2.dsc
c5f89030d94fbda8a2ff3f348abe2c91 27984 net optional
rclone_1.75.2-2.debian.tar.xz
4aae5205fa8ae7e5fb32bd49b59d8599 27302 net optional
rclone_1.75.2-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEI8mpPlhYGekSbQo2Vz7x5L1aAfoFAmrZYzsACgkQVz7x5L1a
AfqmSw/+Jzt1tTuFRR5mQ4W6nH+E+AadrhKZCbY2IynyUkDzAtGSSkkaF2nqhlGh
Vize2Cp9HEdeFpQFSZ5wn77TGvXMD3CST8MJgx5OKKiniqDNPthTUVMsk5OwWAYo
ml5C0WFTxWkJPLg4gqz0/LqsfUoC20T5C4CBM3OQLBzXTC+3S7JmOtV71sGwOM9O
DwfPjiQ29g0f+urhIdU67aU3Ik8BHMdXOjIApghCncXHJG8kAwzPx4wouunfiZpk
YjBiix4cyfEL4kcqCo3KdvnBPFLfZaGeBPo2qcbARyGXpXK4eUQuWBtKyEiGacJs
8rbN9zukoocjwuLzcTihzXjqPhhKdmL5YW9vWVoXBmLKbxqgJp3uOcCyxzMBuNsg
j6NinbAELNh891OX559lcqJ+6ThZX8BFzcW36c/O1Q7eNceJftjTWtvBpmvll+EU
jezJrCcd6dcZ/rmHFPyjOoiTxQZ0BCyGTPWmksO3bWdKTg/isdH1rVMadB08a/bF
v1umw3udYgrm/+7d+zPtuWSD0lbvjge86AEOfvMYByn480cfUutf3S1jxReUf0aK
w+h7kEglz5fkNnRx7PncBGh71dZP3HVktCJ7VP4Q8LSHBPwVzrWB7ClX3ok6bq0u
8UUiFeVIBPsZfaDTVipwD7uWT28UUTx+ncWIRbjzW2Byfy9KJEw=
=6v+V
-----END PGP SIGNATURE-----
pgphpnqJVez71.pgp
Description: PGP signature
--- End Message ---
