From 2c1174af0dfdd8711d7b092a372d8f709fb723e1 Mon Sep 17 00:00:00 2001 From: Nick Craig-Wood Date: Tue, 18 Aug 2026 12:28:18 +0100 Subject: [PATCH] docs: add assigned CVE numbers to the v1.75.0 security advisories in the changelog Five of the advisories released with v1.75.0 now have CVEs assigned: - GHSA-45pq-889g-fcgh serve restic path traversal: CVE-2026-71309 - GHSA-xhf4-832v-7xcr lib/proxy CONNECT header OOM: CVE-2026-71310 - GHSA-8c48-q9wj-3w37 ftp command injection: CVE-2026-71311 - GHSA-2m8m-jhrm-w6j2 sftp PowerShell command injection: CVE-2026-71312 - GHSA-7p4m-qxvv-g567 local file name escape: CVE-2026-71313 GHSA-6jcg-q3wp-x2f4 (squashfs) loses its CVE-PENDING marker as GitHub declined to issue a CVE from the rclone repository - the vulnerable code is in go-diskfs so any CVE must come from an advisory there. GHSA-mfvx-7rcj-9m5g (pprof) keeps its CVE-PENDING marker as the CVE request is still awaiting allocation. --- docs/content/changelog.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/content/changelog.md b/docs/content/changelog.md index eea338ef9..e30db99e3 100644 --- a/docs/content/changelog.md +++ b/docs/content/changelog.md @@ -14,11 +14,11 @@ description: "Rclone Changelog" - [Scality](/s3/#scality) (RING / ARTESCA) - [Zero Services](/s3/#zero-z3) (ZERO-Z3) - Security - - archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING (Nick Craig-Wood) - - ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING (Nick Craig-Wood) + - archive: Don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood) + - ftp: Fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-2026-71311 (Nick Craig-Wood) - lib/http: Use TLS on all `--addr` listeners when `--cert` and `--key` are set GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood) - - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING (Nick Craig-Wood) - - local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-PENDING (Nick Craig-Wood) + - lib/proxy: Fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-2026-71310 (Nick Craig-Wood) + - local: Stop source file names escaping the destination directory GHSA-7p4m-qxvv-g567 CVE-2026-71313 (Nick Craig-Wood) - rc - Don't expose pprof debug handlers on an unauthenticated server GHSA-mfvx-7rcj-9m5g CVE-PENDING (Nick Craig-Wood) - Require authentication to list the remotes with `--rc-serve` GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood) @@ -27,9 +27,9 @@ description: "Rclone Changelog" - Fix redirect credential leaks, reject HTTPS->HTTP and strip secrets GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood) - Strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4 (Nick Craig-Wood) - serve ftp: Use constant time comparison for password check GHSA-mfvx-7rcj-9m5g (Nick Craig-Wood) - - serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-PENDING (Nick Craig-Wood) + - serve restic: Fix path traversal above the served directory GHSA-45pq-889g-fcgh CVE-2026-71309 (Nick Craig-Wood) - serve sftp: Don't crash the whole server on a bad request GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood) - - sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-PENDING (Nick Craig-Wood) + - sftp: Fix command injection via crafted filenames on PowerShell remotes GHSA-2m8m-jhrm-w6j2 CVE-2026-71312 (Nick Craig-Wood) - vfs: Don't crash the process if a backend panics on a background goroutine GHSA-6jcg-q3wp-x2f4 (Nick Craig-Wood) - webdav - Fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj (Nick Craig-Wood)